Setting up a WireGuard server

WireGuard is a lightweight VPN: a few lines of configuration, fast connections, apps for Windows, macOS, Linux, Android and iOS. This guide applies to Debian 13 and Ubuntu 26.04.

Which server

WireGuard runs in the kernel. The simplest option is therefore a vServer with KVM, which has its own kernel. It needs a public IPv4 address and a free UDP port.

1. Installing and generating keys

apt update && apt install wireguard-tools iptables qrencode
cd /etc/wireguard && umask 077
wg genkey | tee server.key | wg pubkey > server.pub
wg genkey | tee handy.key | wg pubkey > handy.pub

2. Server configuration

/etc/wireguard/wg0.conf: insert the keys from the files and replace eth0 with the name of the network interface (ip -br a):

[Interface]
Address    = 10.66.0.1/24
ListenPort = 51820
PrivateKey = <contents of server.key>
PostUp     = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown   = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# Phone
PublicKey  = <contents of handy.pub>
AllowedIPs = 10.66.0.2/32

3. Enabling forwarding and starting

echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-wireguard.conf
sysctl --system
systemctl enable --now wg-quick@wg0

If a firewall is running, UDP port 51820 must be open and forwarding from wg0 to the outside must be allowed (ufw: ufw allow 51820/udp and ufw route allow in on wg0 out on eth0).

4. Connecting a device

Save the following configuration as /etc/wireguard/handy.conf and import it in the WireGuard app as a file or QR code (qrencode -t ansiutf8 < handy.conf):

[Interface]
Address    = 10.66.0.2/32
PrivateKey = <contents of handy.key>
DNS        = 9.9.9.9

[Peer]
PublicKey  = <contents of server.pub>
Endpoint   = <IPv4 address of the server>:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

AllowedIPs = 0.0.0.0/0 sends all IPv4 traffic through the VPN. If only the server should be reachable via the VPN, enter 10.66.0.0/24 there instead.

Check

wg show shows the latest handshake for each device. If nothing is shown there, the device is not getting through: compare the port, endpoint address and key pairs.

See also: View vServer with KVM First steps on the vServer