Skip to content
bashrack

WireGuard · deploy guide

Set up a WireGuard VPN server on a VPS

Turn a bashrack VPS into a private WireGuard VPN: install, generate keys, route client traffic and connect your first device.

about 15 minutes of hands-on time

Who it's for

People who want their own VPN endpoint for travel, remote access or a fixed egress IP.

You'll need

  • An Ubuntu or Debian VPS with your SSH key
  • The WireGuard app on your laptop or phone

Steps

  1. step 1

    Install WireGuard

    Install the tools and create the server key pair.

    bash
    sudo apt-get update && sudo apt-get install -y wireguard ufw
wg genkey | sudo tee /etc/wireguard/server.key | wg pubkey | sudo tee /etc/wireguard/server.pub
sudo chmod 600 /etc/wireguard/server.key

  2. step 2

    Enable IP forwarding

    Let the VPS forward client traffic to the internet.

    bash
    echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-wireguard.conf
sudo sysctl --system

  3. step 3

    Create the server config

    The public interface name differs between servers, so it is detected from the default route. Replace CLIENT_PUBLIC_KEY after the next step.

    bash
    WAN=$(ip -4 route show default | awk '{print $5; exit}')
sudo tee /etc/wireguard/wg0.conf > /dev/null <<EOF
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = $(sudo cat /etc/wireguard/server.key)
PostUp = iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o $WAN -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o $WAN -j MASQUERADE

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.8.0.2/32
EOF

  4. step 4

    Create a client

    Generate the client keys, put the client's public key into wg0.conf, and use this client config in the WireGuard app (replace SERVER_IP with the VPS IP).

    ini
    # on the VPS: wg genkey | tee client.key | wg pubkey > client.pub
[Interface]
PrivateKey = <contents of client.key>
Address = 10.8.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = <contents of /etc/wireguard/server.pub>
Endpoint = SERVER_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

  5. step 5

    Open the port and start the tunnel

    Allow SSH and WireGuard, let ufw forward the tunnel traffic, and start wg0 at boot.

    bash
    sudo ufw allow 22/tcp
sudo ufw allow 51820/udp
sudo sed -i 's/DEFAULT_FORWARD_POLICY="DROP"/DEFAULT_FORWARD_POLICY="ACCEPT"/' /etc/default/ufw
sudo ufw --force enable
sudo systemctl enable --now wg-quick@wg0
sudo wg show

Security and upkeep

  • Never share client private keys; create one key pair per device.
  • Remove a device by deleting its [Peer] block and running: sudo systemctl restart wg-quick@wg0
  • You are responsible for traffic leaving through your VPS under the acceptable use policy.

Official documentation