Configuring WireGuard

Learn how to configure WireGuard, a modern & fast VPN that will allow you to access your home/office network remotely as if you were physically there.

What's WireGuard?

WireGuard is a modern, fast VPN that’s simple to set up. In this post I’ll walk you through a basic server + client setup on Linux (Ubuntu), show key commands, explain the config file fields, and give firewall/NAT and troubleshooting tips. Example configs included. (WireGuardarrow-up-right)

With WireGuard, you can:

  • Create secure VPN tunnels

  • Enjoy high performance — WireGuard is lightweight and much faster than traditional VPNs like OpenVPN or IPSec.

  • Connect across platforms — it works on Linux, Windows, macOS, Android, iOS, and even routers.

  • Access your home/office network remotely as if you were physically there.

  • Bypass NAT and firewalls easily, since it only needs a single UDP port open on the server.

  • And much more!


How it will work

Configuration

Prerequisites

  • A Linux machine to act as the server (a VPS or a home server)

  • A client device (Linux, Windows, macOS...)

  • A public IP or port-forward from your router to the server (UDP port, default 51820). DDNS is also okay.


1

Install WireGuard

In this example, we're using Ubuntu as the server. It should also work for Debian.

2

Generate keys (server & client)

WireGuard uses asymmetric cryptography. A pair of keys is mandatory. Generate a private/public keypair for each peer.

circle-check

Save the private key somewhere safe (only readable by root).

3

Server config

On your server, create the file /etc/wireguard/wg0.conf

Copy the server's private key in this field.

Copy the client's public key in this field.

4

Enable IP forwarding and NAT (server)

Enable IPv4 forwarding immediately:

Make it persistent (add to /etc/sysctl.d/99-sysctl.conf or /etc/sysctl.conf):

Add NAT so clients can reach the Internet through the server (adjust interface name):

5

Client config

On your client, create the file /etc/wireguard/wg0.conf

Copy the client's private key in this field

Copy the server's private key in this field

6

Bring the interface up and enable at boot

Manually bring up:

Enable systemd service (auto-start on boot):

Check status and peer handshakes:


Last updated