How to Deploy WireGuard VPN on a VPS: A Step-by-Step Guide

Your own VPN on your own server is a personal encrypted channel that no one else uses. It keeps no logs, does not throttle your speed, and costs roughly as much as a cup of coffee per month. WireGuard is great because its configuration fits in a dozen lines, and it is noticeably faster than OpenVPN.

Below is the complete path: from purchasing a server to a QR code you scan with your phone. No prior knowledge is required beyond the ability to copy commands — the whole process takes about fifteen minutes.

Step 1. Get a Server

A VPN needs somewhere to live, so we start by renting a VPS. In the NodexGo control panel, this is done as follows:

1. Click the Create Server button.

2. Choose a location. Your actual ping to each location is shown next to it — for a VPN this is the key parameter: the lower the ping, the more transparent the tunnel. Typically you choose the country through which you want to access the internet.

3. Choose a plan and a system image. For WireGuard, the smallest plan is sufficient: 1 vCPU and 2 GB of RAM can handle several dozen devices. The image is Ubuntu 24.04 — all commands below are written for it.

4. Set a server name — for example vpn — and choose a billing period: 1, 3, 6, or 12 months.

5. Confirm the order. The server will be ready in about a minute: the IP address and root password will appear in the panel and be sent to your email.

Step 2. Connect to the Server

Open a terminal (PowerShell on Windows) and connect via SSH, substituting the IP address you were given. You will be prompted for a password — copy it from the panel.

ssh root@your-server-ip

If SSH is not responding for some reason, the server card in the panel includes a VNC web console: it works independently of the network and SSH, and you can always use it to access the system.

Step 3. Update the System and Install WireGuard

First, update the packages — on a fresh image this takes about thirty seconds.

apt update && apt upgrade -y

Install WireGuard itself and the qrencode utility: you will need it at the end to connect your phone with a single scan.

apt install -y wireguard qrencode

Step 4. Generate Keys

WireGuard does not use logins and passwords — instead, each server and each device has a key pair. The umask 077 command ensures that the key files are accessible only to root.

umask 077
wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub
wg genkey | tee /etc/wireguard/client1.key | wg pubkey > /etc/wireguard/client1.pub

You can view the contents of the keys like this — you will need them when filling in the configuration files:

cat /etc/wireguard/server.key /etc/wireguard/server.pub /etc/wireguard/client1.key /etc/wireguard/client1.pub

Step 5. Find the Network Interface Name

The NAT rules require you to specify the interface through which the server accesses the internet. It is most commonly eth0, but it is better to check:

ip -o -4 route show to default | awk '{print $5}'

Step 6. Server Configuration

Create the file /etc/wireguard/wg0.conf. Insert the contents of server.key into PrivateKey, the contents of client1.pub into the PublicKey field of the Peer section, and replace eth0 with the interface name from the previous step.

nano /etc/wireguard/wg0.conf

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.8.0.2/32

Save the file: Ctrl+O, Enter, then Ctrl+X.

Step 7. Enable Packet Forwarding

Without this, the server will accept your connection but will not forward traffic to the internet — this is the typical cause of the issue where the VPN connects but websites do not load.

echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-wireguard.conf
sysctl --system

Step 8. Open the Port and Start the Service

Configure the firewall. It is important to allow SSH before enabling ufw, otherwise you will cut off your own access (and will have to use the VNC console in the panel).

ufw allow OpenSSH
ufw allow 51820/udp
ufw enable

Start the tunnel and enable it on boot so it comes up automatically after a server restart:

systemctl enable --now wg-quick@wg0

Verify that the interface is up:

wg show

Step 9. Client Configuration

Now create a configuration file for your device. PrivateKey takes client1.key, PublicKey takes server.pub, and Endpoint takes your server's IP address.

nano /etc/wireguard/client1.conf

[Interface]
PrivateKey = CLIENT_PRIVATE_KEY
Address = 10.8.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = your-server-ip:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

The line AllowedIPs = 0.0.0.0/0 means all traffic goes through the VPN. If you only need access to the server itself, leave 10.8.0.0/24.

Step 10. Connect Your Phone and Computer

For your phone, install the WireGuard app from the App Store or Google Play and show it the QR code directly from the terminal:

qrencode -t ansiutf8 < /etc/wireguard/client1.conf

Point the app's camera at the code and the profile will be added automatically. For your computer, download the client1.conf file to your machine (run this command in your local terminal, not on the server) and import it into the WireGuard client for Windows or macOS:

scp root@your-server-ip:/etc/wireguard/client1.conf .

Verify the result: enable the VPN and open any IP-checking service — it should show your server's address, not your home one.

How to Add Another Device

Each device needs its own key and its own address: 10.8.0.3, then 10.8.0.4, and so on. Generate keys the same way as in step 4, then add another block to the end of /etc/wireguard/wg0.conf:

[Peer]
PublicKey = SECOND_DEVICE_PUBLIC_KEY
AllowedIPs = 10.8.0.3/32

After editing the configuration, restart the tunnel:

systemctl restart wg-quick@wg0

Troubleshooting

Connection is not establishing — check that port 51820/udp is open and that the correct IP is specified in Endpoint. Remember: WireGuard uses UDP, not TCP.

VPN connected but no internet — this is almost always a forgotten ip_forward from step 7 or an incorrect interface name in the NAT rules from step 5.

Running slowly or large pages fail to load — try adding the line MTU = 1420 to the Interface section of the client configuration.

Lost access to the server entirely — open the VNC web console in the server card in the panel. It also has buttons to Reset Root Password and Reinstall OS if it is easier to start over: reinstallation takes a couple of minutes, and this guide can be repeated in fifteen.

What Server You Need for a VPN

WireGuard barely stresses the CPU: the smallest plan with 1 vCPU and 2 GB of RAM is enough for a family or a small team. The bottleneck is more likely to be traffic, so pay attention to the traffic limit in the plan rather than the number of cores.

If you add more devices or want to route heavy traffic through the tunnel, the server card has an Upgrade Resources button: the plan is switched to a higher tier while the disk and IP address are preserved, so there is no need to reconfigure WireGuard.