How to set up a WireGuard VPN for personal use
VPNs are a great way to level up your privacy online. Here’s how to set one up from scratch.
Step 1: spin up and connect to your cloud server
Using your cloud provider of choice, provision a new server instance. Since the VPN will be for personal use only, inexpensive instances will work fine. Select any operating system that WireGuard supports; we’ll assume Ubuntu for this tutorial.
Connect to your server via SSH as the
Heads up, all commands outlined in this tutorial assume the root user, so you won't see any commands prefixed with
Step 2: install WireGuard
If you picked Ubuntu for your server’s OS, you can install WireGuard with one command:
For the remaining steps, change your working directory to
Step 3: generate a key pair for your VPN server
First, generate a private key:
Then, use the private key to derive a public key:
These are the keys your VPN server will use when encrypting traffic with your client VPN peers.
Step 4: create your server configuration file
With WireGuard installed and keys generated, we’re ready to create our VPN configuration.
First, find the name of the public network interface:
The output might look something like this:
default via ... dev eth0 proto static—the
eth0 part is what we’re after.
Create a file called
wg0.conf with the following contents, being sure to include the private key where required, and replacing
eth0 with the name of the network interface:
Step 5: configure IP forwarding
Add the following line at the bottom of
sysctl -p to load the new configuration.
Step 6: allow UDP traffic
Update the operating system firewall to allow traffic on the port specified in the WireGuard configuration:
Restart UFW to pick up the new configuration:
Step 7: configure the WireGuard server to start on boot
Step 8: generate keys for clients
Now we’ll generate keys for the devices that will be connecting to the server. Follow this process for as many clients as you need:
- Output the private key with
- Output the corresponding public key with
echo -n '<the private key>' | wg pubkey
- Mark the public key as allowed with
wg set wg0 peer <the public key> allowed-ips 10.8.0.2; for each client increment the last digit of the IP address
Verify that the public keys have been added as peers by running the
wg command with no arguments. If you’ve configured three clients, the output should look something like this:
Step 9: configure clients
Finally, configure your client devices to connect to your WireGuard VPN server. This process will be a little different depending on whether you are using the iOS app, Android app, or another Linux installation of WireGuard. Generally, though, your client configuration should look something like this:
0.0.0.0/0 configuration value indicates that all internet traffic should be tunnelled through the VPN connection.