We earn commissions when you shop through the links below. Learn more
How to Set Up a WireGuard VPN on Your Own VPS
Build a fast, private VPN you control on a cheap Ubuntu VPS. Install WireGuard, create keys, route your traffic through the server and connect your phone and laptop, in about 15 minutes.
Ubuntu LTSWireGuardPhone & laptopAbout 15 minutes
Why self-host
Why run your own VPN?
- Safer public Wi-Fi. Your traffic is encrypted to your own server.
- Reach your private services. Access servers and dashboards that aren’t open to the internet.
- A fixed IP address you can allow through firewalls and admin panels.
- Cheap. A small VPS costs less than most VPN subscriptions.
Which VPS to use
WireGuard is extremely light, so even the smallest plan works. RackNerd’s yearly deals cost about $11 a year, and Vultr lets you pick from more than 30 locations if you want your VPN exit in a particular country.
You’ll need a fresh Ubuntu server with SSH access. Our guide on how to set up a VPS covers that in 30 minutes.
Steps 1–2
Install WireGuard and create keys
1. Install WireGuard
sudo apt update
sudo apt install -y wireguard2. Create server and phone keys (as root)
sudo -i
cd /etc/wireguard
umask 077
wg genkey | tee server.key | wg pubkey > server.pub
wg genkey | tee phone.key | wg pubkey > phone.pub
cat server.key phone.pubStay in the root shell for steps 2 and 3 (type exit when done). Each device gets its own key pair. Keep the .key files private; the .pub files are safe to share between server and client. Find your server’s network interface name with ip route list default; it’s the word after dev, often eth0.
Step 3
Create the server configuration
Create /etc/wireguard/wg0.conf with nano /etc/wireguard/wg0.conf (still as root). Paste the contents of server.key and phone.pub where shown, and change eth0 if your interface is named differently:
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = PASTE_SERVER_KEY_HERE
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
[Peer]
# phone
PublicKey = PASTE_PHONE_PUB_HERE
AllowedIPs = 10.8.0.2/32Step 4
Turn on forwarding, open the firewall and start the VPN
Allow the server to route traffic
echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-wireguard.conf
sudo sysctl --systemOpen the firewall and start WireGuard
sudo ufw allow 51820/udp
sudo ufw route allow in on wg0 out on eth0
sudo systemctl enable --now wg-quick@wg0
sudo wg showsudo wg show lists the interface and your phone as a peer. The peer shows a recent handshake once the phone connects.
Step 5
Connect your phone or laptop
Install the official WireGuard app (iPhone, Android, Windows, macOS or Linux) and add a tunnel with this configuration, using the contents of phone.key and server.pub and your server’s IP address:
To scan it on your phone instead of typing, save it as phone.conf on the server, install qrencode and run qrencode -t ansiutf8 < phone.conf, then scan the QR code in the WireGuard app.
Client configuration
[Interface]
PrivateKey = PASTE_PHONE_KEY_HERE
Address = 10.8.0.2/24
DNS = 1.1.1.1
[Peer]
PublicKey = PASTE_SERVER_PUB_HERE
Endpoint = 203.0.113.10:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25Adding a laptop? Create another key pair, add a second [Peer] block on the server with AllowedIPs = 10.8.0.3/32, restart with sudo systemctl restart wg-quick@wg0, and use Address = 10.8.0.3/24 on the laptop.
Still choosing a server? Compare our picks for the best VPS for a VPN on locations, bandwidth and price.
Easier options
Prefer a web dashboard?
If you’d rather click than edit config files, wg-easy runs WireGuard in Docker with a web interface for adding devices and showing QR codes, and PiVPN is a guided installer for WireGuard. Both are free and open source.
Running wg-easy?
It needs Docker first. Our guide on how to install Docker on Ubuntu gets you there in five minutes, including the firewall setting to keep the dashboard private.
Need a server?
Pick a server for your VPN
WireGuard runs on the smallest plans. Pick a host with a location near you, or in the country you want to appear from.
Simple cloud servers with great docs. Add your SSH key when you create a Droplet.
From about $4/month
View DigitalOcean deals4 GB of RAM and NVMe storage on the entry VPS plan, with an easy control panel.
About $5.19/month on a 24-month term with our extra 20% off
Get 20% off Hostinger VPSRackNerd
Yearly KVM VPS deals for about the price of one month elsewhere. Great for learning.
From about $11/year on promo
View RackNerd dealsPrices are approximate. Compare all VPS hosts, including Vultr and ShockHosting.
FAQ
WireGuard VPN questions, answered
Is a self-hosted VPN private?
It encrypts your traffic between your device and your server, which protects you on public Wi-Fi. Websites see your server’s IP address instead of yours. It is not anonymous, because the server is registered to you.
How much does it cost to run my own VPN?
Only the cost of the VPS. WireGuard is free and very light, so even a plan that costs about $1 a month works well for a few devices.
Can I use the VPN for streaming?
It may work, but some streaming services block IP addresses from data centers, so results vary by service and provider.
Why does WireGuard connect but no websites load?
Usually IP forwarding is off, the network interface name in PostUp is wrong, or the firewall blocks routed traffic. Recheck step 4 and the interface name from ip route list default.
Is WireGuard better than OpenVPN?
For most people, yes. WireGuard is faster, simpler to configure and uses modern cryptography. OpenVPN is still useful where its TCP mode helps get past strict firewalls.
How do I remove a device?
Delete its [Peer] block from /etc/wireguard/wg0.conf and restart WireGuard with sudo systemctl restart wg-quick@wg0.