Vai al contenuto
Stato del servizio
VPS e server · 6 min

Your own WireGuard VPN on a VPS in 10 minutes

A personal VPN on your own server gives you a fixed IP for logging in to your infrastructure and a safe tunnel on hotel and café Wi-Fi. Nobody else shares the server. WireGuard is the simplest way to set it up: one config file per side, and the kernel does the rest.

What you need

  • A VPS with Ubuntu 24.04 or Debian 12. WireGuard is light: Pulse (2 vCPU, 2 GB, $10/month) handles a handful of devices without noticing.
  • Root access over SSH.

1. Install and generate keys

apt update && apt install -y wireguard
cd /etc/wireguard && umask 077
wg genkey | tee server.key | wg pubkey > server.pub
wg genkey | tee phone.key | wg pubkey > phone.pub

One key pair for the server, one per device. Repeat the second line for a laptop, a tablet and so on.

2. Server config

Find the name of the external interface first. It is usually eth0, but check:

ip -o -4 route show to default

/etc/wireguard/wg0.conf (replace eth0 if yours differs, and paste the real keys):

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <contents of server.key>
PostUp = iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

[Peer]
# phone
PublicKey = <contents of phone.pub>
AllowedIPs = 10.8.0.2/32

Enable packet forwarding and start the tunnel:

echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-wireguard.conf && sysctl --system
systemctl enable --now wg-quick@wg0

If you use ufw, open the port: ufw allow 51820/udp.

3. Device config

[Interface]
PrivateKey = <contents of phone.key>
Address = 10.8.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = <contents of server.pub>
Endpoint = <server IP>:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Import it into the WireGuard app. On a phone the fastest way is a QR code: save the config on the server as phone.conf, apt install qrencode, and qrencode -t ansiutf8 < phone.conf prints the code right in the terminal. Delete the file once the phone has it.

wg show on the server tells you whether the device has connected (look for a recent "latest handshake").

Things to know before you rely on it

  • All your devices share one IPv4 address, the server's. For logging in to your own servers and admin panels that's exactly what you want: put that IP on the allowlist and close everything else.
  • Traffic isn't limited, speed is shared. dedisrv VPS plans have no monthly traffic quota. The port is 1 Gbit/s, and when several servers on the host are busy, the uplink is split evenly between them.
  • A VPN doesn't make anything legal that wasn't. Our terms prohibit using servers for unlawful purposes, and that includes traffic going through your tunnel.
  • Speed depends on distance. The servers are in the EU, so the further you are from Europe, the more latency the tunnel adds.

Want split tunnelling, where only some traffic goes through the VPN? Replace 0.0.0.0/0 in the device config with the specific networks, for example 10.8.0.0/24 plus your servers' IPs.

Your own WireGuard VPN on a VPS in 10 minutes · dedisrv