Your own WireGuard VPN on a VPS

WireGuard is built into the Linux kernel, fast and simple to set up. With a small VPS you get a private VPN endpoint of your own, in a tolerant offshore location, paid with crypto. This guide uses Debian or Ubuntu and takes about ten minutes.

What you need

• A VPS. Starter at $14 a month is plenty for a few people.
• Debian 12 or Ubuntu 24.04 on it, and root access over SSH.
• The WireGuard app on your phone or computer.

Step 1: install WireGuard

apt update
apt install wireguard qrencode -y

Step 2: let the server forward traffic

echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-wireguard.conf
sysctl --system

Step 3: make the keys

One pair for the server and one for each device. The private keys stay secret.

cd /etc/wireguard
umask 077
wg genkey | tee server.key | wg pubkey > server.pub
wg genkey | tee phone.key | wg pubkey > phone.pub

Step 4: write the server config

First find the name of the network interface. It is the word after dev in this output, often eth0 or ens18:

ip route | grep default

Then create /etc/wireguard/wg0.conf with the real keys in place, and your interface name instead of eth0 if it differs:

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = (contents of server.key)
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = (contents of phone.pub)
AllowedIPs = 10.8.0.2/32

Step 5: start it

systemctl enable --now wg-quick@wg0
wg show

If you use a firewall, open UDP port 51820, for example with ufw allow 51820/udp.

Step 6: connect your phone or laptop

Create phone.conf with the phone's private key and the server's public key and address. Turn it into a QR code and scan it with the WireGuard app:

[Interface]
PrivateKey = (contents of phone.key)
Address = 10.8.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = (contents of server.pub)
Endpoint = 203.0.113.10:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

qrencode -t ansiutf8 < phone.conf

Connect, then look up your IP address in a browser. It should show the address of your VPS.

More devices

Repeat step 3 for each device, give each one the next address, such as 10.8.0.3, and add a [Peer] block for it on the server. Then restart WireGuard:

systemctl restart wg-quick@wg0

Is a VPN allowed on our servers?

Yes. VPN servers and private proxies are welcome on every VPS, and so are Tor bridges and middle relays. Tor exit relays are not allowed on our network. We do not inspect or record your traffic; like every network operator, we keep a record of which IP address belonged to which service.