WireGuard VPN on Linux

Why WireGuard?

WireGuard is simple, fast, and highly secure. Its minimalist codebase means fewer bugs and vulnerabilities compared to legacy VPNs like OpenVPN or IPsec. This guide shows how to stand up a lean VPN with strong defaults.

Think of it like a private tunnel under a busy street. Instead of crossing out in the open where anyone can watch you, you go underground and come out exactly where you meant to, unseen the whole way.

Server prerequisites

1) Choose a Linux server

Pick a VPS with a public IPv4 (and optionally IPv6). Options to consider:

Oracle Cloud Free Tier (always-free instances)
AWS Free Tier (time-limited)
Google Cloud (new-user credits)

2) Install WireGuard

$sudo apt update
$sudo apt install wireguard

For other distros, use the native package manager (e.g., dnf on Fedora/RHEL, pacman on Arch).

3) Generate server keys

$sudo mkdir -p /etc/wireguard/keys
$sudo chmod 700 /etc/wireguard/keys
$cd /etc/wireguard/keys
$sudo wg genkey | sudo tee privatekey | sudo wg pubkey > publickey

privatekey: keep secret
publickey: share with clients

4) Configure `wg0.conf`

$sudo nano /etc/wireguard/wg0.conf

[Interface] PrivateKey = <contents of /etc/wireguard/keys/privatekey> Address = 10.0.0.1/24 ListenPort = 51820 # Enable IP forwarding (runtime) + NAT for egress traffic # NOTE: replace eth0 with your actual NIC (e.g., ens3) PostUp = sysctl -w net.ipv4.ip_forward=1 PostUp = iptables -A FORWARD -i %i -j ACCEPT PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE PostDown = iptables -D FORWARD -i %i -j ACCEPT PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Persist forwarding:

$echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-wireguard.conf
$sudo sysctl --system

5) Open firewall

$sudo ufw allow 51820/udp
$sudo ufw allow OpenSSH
$sudo ufw enable

6) Start the service

$sudo systemctl enable wg-quick@wg0
$sudo systemctl start wg-quick@wg0
$sudo systemctl status wg-quick@wg0 --no-pager

Client configuration

1) Install client software

Linux: via package manager
Windows/macOS: download from wireguard.com
Mobile: App Store / Google Play

2) Generate client keys

$wg genkey | tee client_privatekey | wg pubkey > client_publickey

3) Create `client.conf`

[Interface] PrivateKey = <CLIENT_PRIVATE_KEY> Address = 10.0.0.2/32 DNS = 1.1.1.1 [Peer] PublicKey = <SERVER_PUBLIC_KEY> # Optional extra PSK: # PresharedKey = <PSK> Endpoint = <SERVER_PUBLIC_IP>:51820 AllowedIPs = 0.0.0.0/0 PersistentKeepalive = 25

AllowedIPs 0.0.0.0/0 = full tunnel. For split tunnel, use only needed subnets (e.g., 10.0.0.0/24).

4) Add the client on the server

[Peer] PublicKey = <CLIENT_PUBLIC_KEY> AllowedIPs = 10.0.0.2/32

$sudo systemctl restart wg-quick@wg0

Verify & connect

Import client.conf into the WireGuard app
Activate the tunnel
Verify: curl ifconfig.me or ping internal hosts

Extras & best practices

Multiple clients → unique keypair + /32 IP each (10.0.0.3/32, 10.0.0.4/32, ...)
Keep private keys secret; tight permissions on /etc/wireguard/keys
Interface name may not be eth0 (check with ip a)
Monitor with sudo wg show (handshake, transfer, peers)
Consider IPv6 if your provider supports it
Handy mobile import: qrencode -t ansiutf8 < client.conf

Final thought

Building your own VPN isn’t just about privacy, it’s about control and learning. Verify each step, iterate safely, and you’ll have a fast, reliable tunnel you understand end-to-end.