WireGuard VPN on a VPS: Quick Setup and Configuration

WireGuard is a modern VPN protocol, 2-5 times faster than OpenVPN. It has been built into the Linux kernel since version 5.6. Setup takes 10 minutes.

Installing WireGuard on the Server

sudo apt update
sudo apt install -y wireguard

# Enable IP forwarding
echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Generating Server Keys

cd /etc/wireguard
sudo wg genkey | sudo tee server_private.key | wg pubkey | sudo tee server_public.key
sudo chmod 600 server_private.key

Server Config /etc/wireguard/wg0.conf

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = $(cat /etc/wireguard/server_private.key)
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# Client 1
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.0.0.2/32

Starting WireGuard

sudo systemctl enable --now wg-quick@wg0
sudo wg show  # Check status

Client Config

[Interface]
Address = 10.0.0.2/24
PrivateKey = CLIENT_PRIVATE_KEY
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = YOUR-VPS-IP:51820
AllowedIPs = 0.0.0.0/0  # All traffic through the VPN

QR Code for Your Phone

sudo apt install -y qrencode
qrencode -t ansiutf8 < /etc/wireguard/client.conf

Installing WireGuard

sudo apt update && sudo apt install -y wireguard

# Enable IP forwarding
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Server Configuration /etc/wireguard/wg0.conf

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = $(cat server_private.key)
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = $(cat client_public.key)
AllowedIPs = 10.0.0.2/32

sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0
sudo ufw allow 51820/udp

Why WireGuard Is Better Than OpenVPN

WireGuard runs in the Linux kernel, uses modern cryptography (ChaCha20, Poly1305), and requires minimal configuration. Its speed is 2–4 times higher than OpenVPN.

Client configuration

[Interface]
Address = 10.0.0.2/24
PrivateKey = CLIENT_PRIVATE_KEY
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = YOUR_SERVER_IP:51820
AllowedIPs = 0.0.0.0/0  # All traffic goes through the VPN
PersistentKeepalive = 25

Common WireGuard Setup Errors

Handshake did not complete after 5 seconds

RTNETLINK answers: Operation not permitted

read from tunnel: connection timed out

Interface wg0 is not activated: Address family not supported

WireGuard vs. OpenVPN: A Practical Comparison

When WireGuard Doesn't Fit

• The client's network blocks outbound UDP entirely (some corporate and mobile networks) — WireGuard can't fall back to TCP, so only OpenVPN over 443/tcp will get through
• You need detailed username/password authentication integrated with LDAP/RADIUS — WireGuard only authenticates by public key, with no built-in support for user accounts
• You need official support on legacy OSes without a modern kernel — on old systems a userspace backend is required, which complicates setup compared to OpenVPN
• Security policy requires an auditable, replaceable set of encryption algorithms — WireGuard's cipher suite is deliberately fixed and not configurable

Verifying the Tunnel Actually Works

# On the server: the last handshake time should be recent
sudo wg show wg0 latest-handshakes

# On the client: the real external IP should switch to the server's
curl -s https://ifconfig.me

# End-to-end latency check through the tunnel
ping -c 4 10.0.0.1

1. Run wg show on the server and confirm the peer has a recent latest handshake, not "(none)"
2. From a client connected via VPN, check the external IP with curl ifconfig.me — it should match the server's IP, not the home connection's
3. Run ping to the server's internal address (10.0.0.1) — stable replies confirm traffic is actually flowing through the tunnel
4. Check the traffic counters with wg show wg0 transfer — if only transmit is growing while receive stays at zero, the server isn't getting return traffic, and the issue is NAT or routing

Setting up a baseline firewall before bringing up the VPN is covered in UFW on a VPS, and hardening SSH access to the server itself is covered in SSH hardening.

Frequently asked questions

What's the difference between a VPS and a VPN?

A VPS is a rented virtual server — a separate computer with its own operating system where you can install any software, including a VPN. A VPN is an encrypted-tunnel technology for routing traffic through such a server. In short, a VPS is the infrastructure, while a VPN is one of the services built on top of it.

Why is WireGuard generally faster than OpenVPN?

WireGuard runs directly inside the Linux kernel and uses a small, fixed set of modern encryption algorithms, while OpenVPN runs in user space and supports a wide, configurable cipher set for the sake of compatibility. A smaller codebase and kernel-level operation give WireGuard a noticeable speed advantage and lower latency compared with OpenVPN.

What should you do if a client's network blocks all outbound UDP traffic?

In that case WireGuard won't help, since the protocol has no way to fall back to TCP. The practical workaround is OpenVPN configured over TCP port 443, disguised as ordinary HTTPS traffic, which gets through strict corporate or mobile firewalls in places where UDP traffic is blocked entirely.

How do you confirm a VPN tunnel is actually passing traffic, not just connected?

Checking the connection status alone isn't enough — you need to confirm data is really flowing through the tunnel. A recent handshake on the server, a changed external IP on the client, and both traffic counters growing together confirm the VPN is genuinely working. If only outbound traffic grows while inbound stays at zero, the issue is routing or NAT.