[Tutorial] Setting up a WireGuard VPN on a cheap VPS - complete guide

[Tutorial] Setting up a WireGuard VPN on a cheap VPS - complete guide - Printable Version

+- TalkativeTurtles (https://talkativeturtles.club)
+-- Forum: Community (https://talkativeturtles.club/forumdisplay.php?fid=25)
+--- Forum: Tutorials & Resources (https://talkativeturtles.club/forumdisplay.php?fid=26)
+--- Thread: [Tutorial] Setting up a WireGuard VPN on a cheap VPS - complete guide (/showthread.php?tid=68)

[Tutorial] Setting up a WireGuard VPN on a cheap VPS - complete guide - Zero Two - 06-22-2026

WireGuard is the cleanest way to get a private tunnel between your devices and a server you control. This guide covers setting up a WireGuard server on a Debian/Ubuntu VPS and connecting a Linux client. Adapt for other OS as needed.

Prerequisites

A VPS running Debian 12 or Ubuntu 22.04+ (any cheap £3-5/mo provider works)
Root or sudo access
Your server's public IP address

Step 1: Install WireGuard on the server

Code:
sudo apt update && sudo apt install wireguard -y

Step 2: Generate server keys

Code:
wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key

chmod 600 /etc/wireguard/server_private.key

Step 3: Create server config at /etc/wireguard/wg0.conf

Code:
[Interface]

Address = 10.0.0.1/24

ListenPort = 51820

PrivateKey = <server_private_key>

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]

PublicKey = <client_public_key>

AllowedIPs = 10.0.0.2/32

Step 4: Enable IP forwarding

Code:
echo 'net.ipv4.ip_forward=1' | sudo tee -a /etc/sysctl.conf

sudo sysctl -p

Step 5: Start and enable the service

Code:
sudo systemctl enable --now wg-quick@wg0

Step 6: On the client
Install WireGuard, generate a client keypair the same way, then create /etc/wireguard/wg0.conf:

Code:
[Interface]

Address = 10.0.0.2/24

PrivateKey = <client_private_key>

DNS = 1.1.1.1

[Peer]

PublicKey = <server_public_key>

Endpoint = <server_ip>:51820

AllowedIPs = 0.0.0.0/0

PersistentKeepalive = 25

Bring it up with sudo wg-quick up wg0 and check the connection with sudo wg show.

Set AllowedIPs = 10.0.0.0/24 instead of 0.0.0.0/0 if you only want LAN access rather than routing all traffic through the VPN.

Questions welcome - happy to help troubleshoot.