1. Install WireGuard and Make the Server's Keys
sudo apt update sudo apt install -y wireguard iptables wg genkey | sudo tee /etc/wireguard/server.key | wg pubkey | sudo tee /etc/wireguard/server.pub sudo chmod 600 /etc/wireguard/server.key
2. Make a Key Pair for Your First Device
Easiest on the server for now; the private key goes into the client config and can then be deleted here. (Phone and desktop apps can also generate their own keys — then you only need their public key.)
wg genkey | tee laptop.key | wg pubkey > laptop.pub
3. Write the Server Config
Find the name of your internet-facing interface first — it is the word after dev:
ip route get 1.1.1.1
Then create /etc/wireguard/wg0.conf, replacing eth0 if yours is named differently and pasting the keys where shown. Print them with sudo cat /etc/wireguard/server.key and cat laptop.pub:
[Interface] Address = 10.8.0.1/24 ListenPort = 51820 PrivateKey = <contents of /etc/wireguard/server.key> PostUp = iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE PostDown = iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE [Peer] # laptop PublicKey = <contents of laptop.pub> AllowedIPs = 10.8.0.2/32
sudo chmod 600 /etc/wireguard/wg0.conf
4. Forwarding and Firewall
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-wireguard.conf sudo sysctl --system sudo apt install -y ufw # Debian does not include it sudo ufw allow OpenSSH sudo ufw allow 51820/udp sudo ufw route allow in on wg0 out on eth0 sudo ufw allow in on wg0 # lets VPN clients reach services on the server itself
If you turned on the firewall on your server's page in the dashboard, add its WireGuard preset (UDP 51820) there as well. If you do not use UFW, the port and forwarding rules still need to be allowed in whatever firewall you do use. The UFW article covers the basics.
5. Start It
sudo systemctl enable --now wg-quick@wg0 sudo wg show
6. Configure the Device
Install the WireGuard app (Windows, macOS, iOS, Android, or the wireguard package on Linux) and import a config like this:
[Interface] PrivateKey = <contents of laptop.key> Address = 10.8.0.2/32 DNS = 1.1.1.1 [Peer] PublicKey = <contents of /etc/wireguard/server.pub> Endpoint = 203.0.113.10:51820 AllowedIPs = 0.0.0.0/0, ::/0 PersistentKeepalive = 25
AllowedIPs = 0.0.0.0/0, ::/0 sends all traffic through the VPN. Keep the ::/0 even though this setup only routes IPv4: without it, your device's IPv6 traffic goes around the VPN instead of through it. To use it only for reaching the server and other VPN devices, use AllowedIPs = 10.8.0.0/24 instead. For a phone, save the config on the server as phone.conf, then sudo apt install qrencode && qrencode -t ansiutf8 < phone.conf prints it as a QR code the app can scan.
Once connected, sudo wg show on the server shows a recent handshake, and a “what is my IP” site shows the server's address. Delete laptop.key from the server when you are done.
Adding More Devices
Repeat step 2 for each device, add a [Peer] block with the next free address, and apply it without dropping existing connections:
sudo bash -c 'wg syncconf wg0 <(wg-quick strip wg0)'