[Zero Two]

WireGuard is the cleanest way to get a private tunnel between your devices and a server you control. This guide covers setting up a WireGuard server on a Debian/Ubuntu VPS and connecting a Linux client. Adapt for other OS as needed.

Prerequisites

• A VPS running Debian 12 or Ubuntu 22.04+ (any cheap £3-5/mo provider works)
  
• Root or sudo access
  
• Your server's public IP address
  

Step 1: Install WireGuard on the server

Code:

sudo apt update && sudo apt install wireguard -y

Step 2: Generate server keys

Code:

wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key
chmod 600 /etc/wireguard/server_private.key

Step 3: Create server config at /etc/wireguard/wg0.conf

Code:

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <server_private_key>

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = <client_public_key>
AllowedIPs = 10.0.0.2/32

Step 4: Enable IP forwarding

Code:

echo 'net.ipv4.ip_forward=1' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Step 5: Start and enable the service

Code:

sudo systemctl enable --now wg-quick@wg0

Step 6: On the client
Install WireGuard, generate a client keypair the same way, then create /etc/wireguard/wg0.conf:

Code:

[Interface]
Address = 10.0.0.2/24
PrivateKey = <client_private_key>
DNS = 1.1.1.1

[Peer]
PublicKey = <server_public_key>
Endpoint = <server_ip>:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Bring it up with sudo wg-quick up wg0 and check the connection with sudo wg show.

Set AllowedIPs = 10.0.0.0/24 instead of 0.0.0.0/0 if you only want LAN access rather than routing all traffic through the VPN.

Questions welcome - happy to help troubleshoot.