How do you set up WireGuard on a Linux VPS for your own devices and servers?

What is WireGuard on a VPS good for?

A VPS gives your own devices a fixed, public meeting point, so they can reach each other wherever they are. Typical jobs:

• Reach a database, an admin panel or SSH on your servers over the tunnel, and close those ports to the internet.
• Join servers in two cities, say New York and Frankfurt, on one private subnet.
• Reach your home NAS from your phone without opening a port on the home router: the NAS connects out to the VPS.
• On hotel or café Wi-Fi, send your laptop's traffic through a server you control.

What you rent is Linux VPS on KVM in New York, Dallas, Los Angeles, London, Amsterdam and Frankfurt: a virtual machine with its own kernel, where you are root over SSH. The WireGuard module of the stock kernel loads as on any computer; container-based hosting often cannot do that. Debian 13 runs Linux 6.12 and Debian 12 runs 6.1, and kernels from 5.6 on include WireGuard.

The examples use 10.8.0.0/24 and fd42:8::/64 inside the tunnel, 203.0.113.10 as the VPS address, and eth0 as its public interface: ip route show default tells you the real name.

How do you install WireGuard and create the keys?

One package, then one key pair per device. Only public keys ever travel between machines. A laptop running Linux makes its pair with the same two commands; the WireGuard apps for phones and desktops generate theirs and show the public key. Keep umask 077 so the private key file is readable by root only.

apt install wireguard qrencode
cd /etc/wireguard
umask 077
wg genkey | tee server.key | wg pubkey > server.pub
cat server.pub

What goes in the server's wg0.conf?

An [Interface] with the server's address, port and private key, then one [Peer] per device. AllowedIPs does two jobs, which WireGuard calls cryptokey routing. For outgoing packets, the destination address picks the peer. For incoming packets, it is an access list: a packet from that peer with any other source address is dropped. On the server, give each device its own /32 and /128, and open the UDP port in the firewall.

[Interface]
Address = 10.8.0.1/24, fd42:8::1/64
ListenPort = 51820
PrivateKey = <contents of server.key>

[Peer]
# alice-laptop
PublicKey = <laptop public key>
AllowedIPs = 10.8.0.2/32, fd42:8::2/128

[Peer]
# db1, a server in another city
PublicKey = <db1 public key>
AllowedIPs = 10.8.0.3/32, fd42:8::3/128

chmod 600 /etc/wireguard/wg0.conf
ufw allow 51820/udp
systemctl enable --now wg-quick@wg0
wg show

What goes on the laptop or phone?

The mirror image: its own private key and address, and the server as its single peer. With AllowedIPs = 10.8.0.0/24, fd42:8::/64 only traffic for the private network enters the tunnel; everything else leaves through the local connection as before.

PersistentKeepalive is off by default. WireGuard's quick start advises it only for a peer behind NAT that must stay reachable while idle, and gives 25 seconds as an interval that suits most firewalls. A phone or a home NAS fits that case.

On Linux, wg-quick up wg0 brings the file up. For a phone, show the file as a QR code in the terminal and scan it with the app, then delete the file from the server.

[Interface]
PrivateKey = <laptop private key>
Address = 10.8.0.2/32, fd42:8::2/128

[Peer]
PublicKey = <contents of server.pub>
Endpoint = 203.0.113.10:51820
AllowedIPs = 10.8.0.0/24, fd42:8::/64
PersistentKeepalive = 25

# on the VPS, for a phone peer written to phone.conf:
# qrencode -t ansiutf8 < phone.conf

How do peers reach each other, or the internet, through the VPS?

Turn on forwarding in a file under /etc/sysctl.d/, and add NAT only if a device sends all its traffic through the tunnel. Debian 13's systemd-sysctl no longer reads /etc/sysctl.conf, so a snippet in /etc/sysctl.d/ is the form that works on every release.

One trap: with forwarding on, Linux stops accepting IPv6 router advertisements on the public interface. If the VPS got its IPv6 route that way, set accept_ra = 2 on that interface in the same file, or IPv6 stops working after sysctl --system.

For a full tunnel, the laptop uses AllowedIPs = 0.0.0.0/0, ::/0 and a DNS = line. Listing 0.0.0.0/0 alone would leave IPv6 traffic outside the tunnel. The server then masquerades tunnel addresses behind its own, with an nftables table that wg-quick creates and removes. If ufw is active, its forward policy drops routed packets until you allow them.

cat > /etc/sysctl.d/99-wireguard.conf <<'EOF'
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
# only if eth0 takes its IPv6 route from router advertisements
net.ipv6.conf.eth0.accept_ra = 2
EOF
sysctl --system

# add to [Interface] in /etc/wireguard/wg0.conf for a full tunnel
PostUp = nft add table inet wgnat
PostUp = nft add chain inet wgnat post '{ type nat hook postrouting priority 100; }'
PostUp = nft add rule inet wgnat post oifname eth0 ip saddr 10.8.0.0/24 masquerade
PostUp = nft add rule inet wgnat post oifname eth0 ip6 saddr fd42:8::/64 masquerade
PostDown = nft delete table inet wgnat

# with ufw active: peer to peer, and peers out to the internet
ufw route allow in on wg0 out on wg0
ufw route allow in on wg0 out on eth0

How do you check, extend and tighten the tunnel?

wg show is the first check: each peer should list a recent latest handshake and growing transfer counters. A peer with no handshake has a wrong key, a wrong endpoint or a closed UDP port. Then test what you actually need: ssh [email protected] from the laptop, a database client against 10.8.0.3, a name lookup through the tunnel if you set DNS =.

To add or remove a device, edit wg0.conf and reload the peers without dropping the others. Once SSH works over the tunnel, you can allow it only on wg0 and remove the public rule. Do that with a second session open, as described in SSH keys and server security.

A tunnel does not hide your traffic from the network it ends on: past the VPS, it crosses the data center network like any other. What your VPS host can see goes through what stays visible.

wg syncconf wg0 <(wg-quick strip wg0)
wg show wg0 latest-handshakes

ufw allow in on wg0 to any port 22 proto tcp
ufw delete allow 22/tcp

Which plan fits a WireGuard endpoint?

Byte, unless a full tunnel carries a household's downloads; then traffic, not CPU, decides. WireGuard's encryption costs little CPU. Each VPS comes with a dedicated IPv4 address and a routed IPv6 /64. Every plan lists its outbound traffic per month in TB, and going over it never triggers an automatic charge. Every byte the VPS relays back to your devices counts as outbound traffic. Plans connect through a 1 Gbit/s port that the VPS on the same host share.

• Byte (1 vCPU / 2 GB / 40 GB), 2 TB a month: a private network for admin access and a few devices. $2.25 a month on a 12-month term.
• Kilo (2 vCPU / 4 GB / 65 GB), 2 TB a month: full tunnels for a few people, or WireGuard next to other services. $4.49 a month on a 12-month term.
• Mega (2 vCPU / 6 GB / 120 GB), 6 TB a month: when the same VPS also runs Nextcloud or a site. $6.75 a month on a 12-month term.

Pick the city close to the devices or servers you connect: New York, Dallas and Los Angeles in the United States; London, Amsterdam and Frankfurt in Europe: every plan in every city, at one price.