compare VPS providers on our comparison table<\/a> to find one that meets your needs. A 1 vCPU \/ 1 GB RAM plan is sufficient for dozens of VPN clients.<\/p>\n\n\n\nStep 1: Install WireGuard<\/h2>\n\n\n\n
SSH into your VPS and run:<\/p>\n\n\n\n
sudo apt update\nsudo apt install wireguard -y<\/code><\/pre>\n\n\n\nOn newer kernels (5.6+), the WireGuard module is already loaded. Verify with:<\/p>\n\n\n\n
sudo modprobe wireguard\nlsmod | grep wireguard<\/code><\/pre>\n\n\n\nStep 2: Generate Keys<\/h2>\n\n\n\n
WireGuard uses Curve25519 key pairs. Generate the server keys:<\/p>\n\n\n\n
cd \/etc\/wireguard\numask 077\nwg genkey | tee server_private_key | wg pubkey > server_public_key<\/code><\/pre>\n\n\n\nThis creates two files. Save the public key \u2014 you’ll need it when configuring clients.<\/p>\n\n\n\n
Step 3: Create the Server Configuration<\/h2>\n\n\n\n
Create \/etc\/wireguard\/wg0.conf<\/code>:<\/p>\n\n\n\n[Interface]\nAddress = 10.0.0.1\/24\nListenPort = 51820\nPrivateKey = <paste-server-private-key>\n\n# Enable IP forwarding (required for NAT)\nPostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE\nPostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE\n\n# Client 1: Laptop\n[Peer]\nPublicKey = <client1-public-key>\nAllowedIPs = 10.0.0.2\/32\n\n# Client 2: Phone\n[Peer]\nPublicKey = <client2-public-key>\nAllowedIPs = 10.0.0.3\/32<\/code><\/pre>\n\n\n\nReplace eth0<\/code> with your server’s public network interface (check with ip route | grep default<\/code>). The PostUp\/PostDown<\/code> rules enable NAT so client traffic routes through your server.<\/p>\n\n\n\nStep 4: Enable IP Forwarding<\/h2>\n\n\n\n
Uncomment net.ipv4.ip_forward=1<\/code> in \/etc\/sysctl.conf<\/code>, then apply:<\/p>\n\n\n\nsudo sysctl -p<\/code><\/pre>\n\n\n\nStep 5: Configure the Firewall<\/h2>\n\n\n\n
Open the WireGuard port and enable forwarding in UFW:<\/p>\n\n\n\n
sudo ufw allow 51820\/udp\nsudo ufw enable<\/code><\/pre>\n\n\n\nIf you’re using iptables directly, add:<\/p>\n\n\n\n
sudo iptables -A INPUT -p udp --dport 51820 -j ACCEPT<\/code><\/pre>\n\n\n\nStep 6: Create Client Configurations<\/h2>\n\n\n\n
On each client machine, generate its own key pair similarly. Then create a client config file (e.g., \/etc\/wireguard\/wg0.conf<\/code> on Linux, or imported into the WireGuard GUI app on Windows\/macOS):<\/p>\n\n\n\n[Interface]\nAddress = 10.0.0.2\/24\nPrivateKey = <client-private-key>\nDNS = 1.1.1.1, 8.8.8.8\n\n[Peer]\nPublicKey = <server-public-key>\nEndpoint = your-vps-ip:51820\nAllowedIPs = 0.0.0.0\/0\nPersistentKeepalive = 25<\/code><\/pre>\n\n\n\nAllowedIPs = 0.0.0.0\/0<\/code> routes all traffic through the VPN (full tunnel). To only route traffic to your VPS’s subnet, use AllowedIPs = 10.0.0.0\/24<\/code> instead (split tunnel).<\/p>\n\n\n\nStep 7: Start WireGuard<\/h2>\n\n\n\n
On the server, start and enable the service:<\/p>\n\n\n\n
sudo systemctl enable wg-quick@wg0\nsudo systemctl start wg-quick@wg0<\/code><\/pre>\n\n\n\nCheck the status:<\/p>\n\n\n\n
sudo wg show<\/code><\/pre>\n\n\n\nYou should see the interface, the listening port, and each connected peer with transfer statistics.<\/p>\n\n\n\n
Step 8: Test the Connection<\/h2>\n\n\n\n
On the client, bring up the tunnel:<\/p>\n\n\n\n
\n- Linux:<\/strong>
sudo wg-quick up wg0<\/code><\/li>\n- Windows\/macOS:<\/strong> Import the config into the official WireGuard app and click Activate<\/li>\n
- iOS\/Android:<\/strong> Scan the config QR code (generate with
qrencode -t ansiutf8 < client.conf<\/code>)<\/li>\n<\/ul>\n\n\n\nVerify your IP is now the VPS’s IP:<\/p>\n\n\n\n
curl ifconfig.me<\/code><\/pre>\n\n\n\n