# How do you set up WireGuard on a Linux VPS for your own devices and servers?

> Set up WireGuard on a Linux VPS for your own devices and servers: keys, wg0.conf, UDP port 51820, forwarding and nftables NAT. Debian 13 and Ubuntu 24.04.

- URL: https://vpswithcrypto.com/wireguard-on-a-vps/
- Last updated: 2026-11-03
- Publisher: VPS With Crypto (https://vpswithcrypto.com)

A private network between your laptop, your phone and your servers, with the VPS as the fixed meeting point: keys, the two configuration files, the firewall, forwarding between peers, and how to keep admin ports off the public internet.

**Quick answer — How do I run WireGuard on my own VPS?**

Install `wireguard`, create one key pair per device, write `/etc/wireguard/wg0.conf`, open UDP port 51820 and start `wg-quick@wg0`. WireGuard ships in the stock kernel of Debian 13 and Ubuntu 24.04, so a VPS With Crypto KVM VPS runs it with no extra module. A Byte plan is enough for a private network of a few laptops, phones and servers, as checked on 3 November 2026.

## What is WireGuard on a VPS good for?

**A VPS gives your own devices a fixed, public meeting point, so they can reach each other wherever they are.** Typical jobs:

- Reach a database, an admin panel or SSH on your servers over the tunnel, and close those ports to the internet.
- Join servers in two cities, say New York and Frankfurt, on one private subnet.
- Reach your home NAS from your phone without opening a port on the home router: the NAS connects out to the VPS.
- On hotel or café Wi-Fi, send your laptop's traffic through a server you control.

What you rent is Linux VPS on KVM in New York, Dallas, Los Angeles, London, Amsterdam and Frankfurt: a virtual machine with its own kernel, where you are root over SSH. The WireGuard module of the stock kernel loads as on any computer; container-based hosting often cannot do that. Debian 13 runs Linux 6.12 and Debian 12 runs 6.1, and kernels from 5.6 on include WireGuard.

The examples use `10.8.0.0/24` and `fd42:8::/64` inside the tunnel, `203.0.113.10` as the VPS address, and `eth0` as its public interface: `ip route show default` tells you the real name.

## How do you install WireGuard and create the keys?

**One package, then one key pair per device.** Only public keys ever travel between machines. A laptop running Linux makes its pair with the same two commands; the WireGuard apps for phones and desktops generate theirs and show the public key. Keep `umask 077` so the private key file is readable by root only.

*On the VPS (Debian 13, Debian 12, Ubuntu 24.04)*

```bash
apt install wireguard qrencode
cd /etc/wireguard
umask 077
wg genkey | tee server.key | wg pubkey > server.pub
cat server.pub
```

## What goes in the server's wg0.conf?

**An `[Interface]` with the server's address, port and private key, then one `[Peer]` per device.** `AllowedIPs` does two jobs, which WireGuard calls cryptokey routing. For outgoing packets, the destination address picks the peer. For incoming packets, it is an access list: a packet from that peer with any other source address is dropped. On the server, give each device its own `/32` and `/128`, and open the UDP port in the firewall.

*/etc/wireguard/wg0.conf on the VPS*

```ini
[Interface]
Address = 10.8.0.1/24, fd42:8::1/64
ListenPort = 51820
PrivateKey = <contents of server.key>

[Peer]
# alice-laptop
PublicKey = <laptop public key>
AllowedIPs = 10.8.0.2/32, fd42:8::2/128

[Peer]
# db1, a server in another city
PublicKey = <db1 public key>
AllowedIPs = 10.8.0.3/32, fd42:8::3/128
```

*Start it now and at every boot*

```bash
chmod 600 /etc/wireguard/wg0.conf
ufw allow 51820/udp
systemctl enable --now wg-quick@wg0
wg show
```

## What goes on the laptop or phone?

**The mirror image: its own private key and address, and the server as its single peer.** With `AllowedIPs = 10.8.0.0/24, fd42:8::/64` only traffic for the private network enters the tunnel; everything else leaves through the local connection as before.

`PersistentKeepalive` is off by default. WireGuard's quick start advises it only for a peer behind NAT that must stay reachable while idle, and gives 25 seconds as an interval that suits most firewalls. A phone or a home NAS fits that case.

On Linux, `wg-quick up wg0` brings the file up. For a phone, show the file as a QR code in the terminal and scan it with the app, then delete the file from the server.

*Client file, then a QR code for the phone app*

```ini
[Interface]
PrivateKey = <laptop private key>
Address = 10.8.0.2/32, fd42:8::2/128

[Peer]
PublicKey = <contents of server.pub>
Endpoint = 203.0.113.10:51820
AllowedIPs = 10.8.0.0/24, fd42:8::/64
PersistentKeepalive = 25

# on the VPS, for a phone peer written to phone.conf:
# qrencode -t ansiutf8 < phone.conf
```

## How do peers reach each other, or the internet, through the VPS?

**Turn on forwarding in a file under `/etc/sysctl.d/`, and add NAT only if a device sends all its traffic through the tunnel.** Debian 13's systemd-sysctl no longer reads `/etc/sysctl.conf`, so a snippet in `/etc/sysctl.d/` is the form that works on every release.

One trap: with forwarding on, Linux stops accepting IPv6 router advertisements on the public interface. If the VPS got its IPv6 route that way, set `accept_ra = 2` on that interface in the same file, or IPv6 stops working after `sysctl --system`.

For a full tunnel, the laptop uses `AllowedIPs = 0.0.0.0/0, ::/0` and a `DNS =` line. Listing `0.0.0.0/0` alone would leave IPv6 traffic outside the tunnel. The server then masquerades tunnel addresses behind its own, with an nftables table that `wg-quick` creates and removes. If ufw is active, its forward policy drops routed packets until you allow them.

*Forwarding, then NAT in wg0.conf, then ufw route rules*

```bash
cat > /etc/sysctl.d/99-wireguard.conf <<'EOF'
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
# only if eth0 takes its IPv6 route from router advertisements
net.ipv6.conf.eth0.accept_ra = 2
EOF
sysctl --system

# add to [Interface] in /etc/wireguard/wg0.conf for a full tunnel
PostUp = nft add table inet wgnat
PostUp = nft add chain inet wgnat post '{ type nat hook postrouting priority 100; }'
PostUp = nft add rule inet wgnat post oifname eth0 ip saddr 10.8.0.0/24 masquerade
PostUp = nft add rule inet wgnat post oifname eth0 ip6 saddr fd42:8::/64 masquerade
PostDown = nft delete table inet wgnat

# with ufw active: peer to peer, and peers out to the internet
ufw route allow in on wg0 out on wg0
ufw route allow in on wg0 out on eth0
```

## How do you check, extend and tighten the tunnel?

**`wg show` is the first check: each peer should list a recent `latest handshake` and growing `transfer` counters.** A peer with no handshake has a wrong key, a wrong endpoint or a closed UDP port. Then test what you actually need: `ssh alice@10.8.0.1` from the laptop, a database client against `10.8.0.3`, a name lookup through the tunnel if you set `DNS =`.

To add or remove a device, edit `wg0.conf` and reload the peers without dropping the others. Once SSH works over the tunnel, you can allow it only on `wg0` and remove the public rule. Do that with a second session open, as described in [SSH keys and server security](https://vpswithcrypto.com/ssh-keys-and-server-security/ "How do you set up SSH keys and lock down SSH on a Linux VPS?").

A tunnel does not hide your traffic from the network it ends on: past the VPS, it crosses the data center network like any other. [What your VPS host can see](https://vpswithcrypto.com/what-your-vps-host-can-see/ "What can your VPS host see?") goes through what stays visible.

*Reload peers, then keep SSH on the tunnel only*

```bash
wg syncconf wg0 <(wg-quick strip wg0)
wg show wg0 latest-handshakes

ufw allow in on wg0 to any port 22 proto tcp
ufw delete allow 22/tcp
```

## Which plan fits a WireGuard endpoint?

**Byte, unless a full tunnel carries a household's downloads; then traffic, not CPU, decides.** WireGuard's encryption costs little CPU. Each VPS comes with a dedicated IPv4 address and a routed IPv6 /64. Every plan lists its outbound traffic per month in TB, and going over it never triggers an automatic charge. Every byte the VPS relays back to your devices counts as outbound traffic. Plans connect through a 1 Gbit/s port that the VPS on the same host share.

- **Byte** (1 vCPU / 2 GB / 40 GB), 2 TB a month: a private network for admin access and a few devices. $2.25 a month on a 12-month term.
- **Kilo** (2 vCPU / 4 GB / 65 GB), 2 TB a month: full tunnels for a few people, or WireGuard next to other services. $4.49 a month on a 12-month term.
- **Mega** (2 vCPU / 6 GB / 120 GB), 6 TB a month: when the same VPS also runs Nextcloud or a site. $6.75 a month on a 12-month term.

Pick the city close to the devices or servers you connect: New York, Dallas and Los Angeles in the United States; London, Amsterdam and Frankfurt in Europe: every plan in every city, at one price.

## What else do people ask about WireGuard on a VPS?

### Which port does WireGuard need?

The UDP port you set in `ListenPort` on the server. 51820 is the one WireGuard's own examples use. Clients need no open port: they connect out.

### Do I need PersistentKeepalive?

Only on a peer behind NAT that must receive packets while idle, such as a home NAS or a phone you want to reach. WireGuard leaves it off by default and suggests 25 seconds when it is needed.

### Can the tunnel run over IPv6?

Yes, both inside and outside. Put the VPS's IPv6 address in brackets in `Endpoint`, such as `[2001:db8::10]:51820`, and give peers addresses from both families inside the tunnel, as in the examples above.

### What do I do when a phone or laptop is lost?

Delete its `[Peer]` block from `wg0.conf` on the server and run `wg syncconf wg0 <(wg-quick strip wg0)`. Its key stops working at once, and the other devices keep their tunnels. Give the replacement device a new key pair rather than a copy of the old one.

### Does traffic inside the tunnel count toward my plan?

Yes. The tunnel is encrypted, but it is still traffic leaving the VPS, measured like any other against the TB a month of your plan.

**A fixed endpoint for your own devices** Byte gives 2 TB a month for $2.25 a month on a 12-month term, in New York, Dallas, Los Angeles, London, Amsterdam or Frankfurt, paid in crypto with no ID. [See plans and prices](https://vpswithcrypto.com/pricing/ "How much does a VPS With Crypto server cost per month?") · [How ordering works](https://vpswithcrypto.com/how-it-works/ "How do I order a VPS with crypto, from payment to SSH?")

## Sources

1. [WireGuard: cryptokey routing](https://www.wireguard.com/) — WireGuard (read 2026-11-03)
2. [WireGuard quick start (keys, PersistentKeepalive)](https://www.wireguard.com/quickstart/) — WireGuard (read 2026-11-03)
3. [Installation (apt install wireguard on Debian and Ubuntu)](https://www.wireguard.com/install/) — WireGuard (read 2026-11-03)
4. [wg-quick(8)](https://man7.org/linux/man-pages/man8/wg-quick.8.html) — man7.org (read 2026-11-03)
5. [Debian 13 release notes: what's new (kernel 6.12)](https://www.debian.org/releases/trixie/release-notes/whats-new.en.html) — Debian (read 2026-11-03)
6. [Debian 13 release notes: systemd-sysctl and /etc/sysctl.conf](https://www.debian.org/releases/trixie/release-notes/issues.en.html) — Debian (read 2026-11-03)
7. [IP sysctl: accept_ra and forwarding](https://docs.kernel.org/networking/ip-sysctl.html) — The Linux kernel documentation (read 2026-11-03)
8. [Firewalls (ufw)](https://ubuntu.com/server/docs/how-to/security/firewalls/) — Canonical (read 2026-11-03)

---

VPS With Crypto: VPS With Crypto sells Linux KVM VPS in New York, Dallas, Los Angeles, London, Amsterdam and Frankfurt, paid in crypto with no ID upload. The business behind it is DomaineGoat LLC, registered in Panama. A plan costs the same in all six cities, and on a 12-month term it is priced at least 25% under a named comparable plan, chosen among 34 no-KYC crypto hosts and read on 3 November 2026.