How to Deploy WireGuard VPN on a VPS: A Step-by-Step Guide

WireGuard is a modern VPN protocol that stands out for its minimalist codebase, high performance, and ease of configuration compared to OpenVPN or IPsec. It has been built into the Linux kernel since version 5.6, making it a reliable and efficient choice for personal use, bypassing restrictions, or setting up a secure corporate network. In this article, we will walk through the complete process of deploying WireGuard on a VPS server running Ubuntu or Debian.

Server Preparation

Before proceeding with the installation, make sure your VPS is up to date and accessible via SSH. Run apt update && apt upgrade -y to synchronize packages and install the latest security updates. Also ensure you have superuser privileges, as most commands will require running with sudo or as root. If your provider supplies a minimal system image, that environment will be more than sufficient.

Installing WireGuard

On Ubuntu and Debian, installation is done with a single command: apt install wireguard -y. Once the installation is complete, the wg utility and the helper tool wg-quick will be available on the system, simplifying interface management. Verify that the kernel module is loaded correctly by running modinfo wireguard. On most modern VPS instances with an up-to-date kernel, no additional steps will be required.

Generating Keys and Creating the Server Configuration

WireGuard uses asymmetric key pairs to authenticate tunnel participants. Generate the server's private and public keys with the following commands: wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key. Then create the configuration file /etc/wireguard/wg0.conf. In the Interface section, specify the server's private key, the interface address within your virtual subnet (for example, 10.0.0.1/24), and the listening port (the standard is 51820/UDP). Make sure the configuration file is accessible only to the root user: chmod 600 /etc/wireguard/wg0.conf.

To properly route client traffic through the server, you need to enable IP forwarding. Open the file /etc/sysctl.conf and uncomment the line net.ipv4.ip_forward=1, then apply the changes with sysctl -p. Also add iptables NAT rules to the PostUp section of the configuration file so that client traffic exits through the server's external interface. This is standard practice when using WireGuard as a full VPN gateway.

Configuring the Client and Adding a Peer

On the client device, generate a key pair in the same way. Create a client configuration file: in the Interface section, specify the client's private key and its IP address within the virtual subnet (for example, 10.0.0.2/32). In the Peer section, enter the server's public key, its external IP address and port in the Endpoint field, and set AllowedIPs to 0.0.0.0/0 if you want to route all traffic through the tunnel. The PersistentKeepalive = 25 parameter will help keep the connection alive when operating behind NAT.

On the server, add the client as a peer in the wg0.conf file: create a Peer section with the client's public key and the allowed IP address (AllowedIPs = 10.0.0.2/32). After that, restart the interface with wg-quick down wg0 && wg-quick up wg0, or apply the changes without dropping connections using wg syncconf wg0 <(wg-quick strip wg0). You can check the tunnel status and active connections with the wg show command.

Autostart and Connection Verification

To have WireGuard start automatically after a server reboot, enable the corresponding systemd service: systemctl enable wg-quick@wg0. Start it with systemctl start wg-quick@wg0 and check its status with systemctl status wg-quick@wg0. To verify the tunnel is working from the client side, ping the server's address on the virtual network (10.0.0.1). If packets go through, the configuration is correct. You can also check your external IP using a service like ifconfig.me, which should match the IP of your VPS.

Conclusion

WireGuard is one of the best tools for establishing a secure VPN connection thanks to its simplicity, speed, and native support in modern Linux kernels. You can deploy it on a VPS in as little as 15 to 20 minutes by following the steps described above. The key is to manage your keys carefully and configure routing on the server correctly.

If you have not yet decided on a platform to host your VPN server, take a look at NodexGo (nodex-go.com), a hosting provider that offers VPS rental with fast deployment and support for popular Linux distributions. You can rent a suitable server and start configuring WireGuard using this guide within minutes.