Knowledgebase

WireGuard is a high-performance VPN solution that is gaining popularity due to its simplicity and strong security features. Unlike traditional VPN protocols, WireGuard uses state-of-the-art cryptography to provide faster speeds and less overhead. This tutorial will guide you through the process of installing and setting up WireGuard on a VPS, allowing you to create a secure private network for your personal or business needs.

Step 1: Choose a VPS Provider and Set Up Your Server

1. Select a VPS Provider

   • Choose a reputable VPS provider, such as DigitalOcean, Vultr, Linode, or AnonVM. Any basic VPS plan should suffice for a small to medium-scale VPN setup (1GB of RAM and 1 vCPU is typically enough).

2. Set Up the Operating System

   • This guide assumes you're using Ubuntu 20.04 or later, but the process is similar on other Linux distributions. Start by connecting to your VPS using SSH:
      

     ssh username@your-vps-ip

3. Update the System

   • Before beginning, update your server's package list and installed packages:
      

     sudo apt update && sudo apt upgrade -y

Step 2: Install WireGuard

1. Install WireGuard from the Official Repository

   • WireGuard is included in the official repositories for Ubuntu 20.04 and later. Install it using the following command:
      

     sudo apt install wireguard -y

2. Verify Installation

   • After installation, you can verify that WireGuard is successfully installed by checking its version:
      

     wg --version

Step 3: Generate Key Pairs

WireGuard uses public and private key pairs for authentication between peers (the server and clients). Follow these steps to generate the keys:

1. Generate Server Keys

   • On the server, generate the private and public keys:

      

     umask 0777 wg genkey | tee privatekey | wg pubkey > publickey

   • This command will generate two files in the current directory:

     • privatekey: Contains the server's private key
     • publickey: Contains the server's public key

2. Save the Keys

   • It’s important to store these keys securely. You can move them to a specific directory:
      

     sudo mv privatekey /etc/wireguard/ sudo mv publickey /etc/wireguard/

3. Generate Client Keys

   • On your client machine (local computer), generate a key pair using the same command:
      

     wg genkey | tee privatekey | wg pubkey > publickey

Step 4: Configure WireGuard Server

1. Create the Server Configuration File

   • Create a configuration file for the WireGuard server at /etc/wireguard/wg0.conf:

      

     sudo nano /etc/wireguard/wg0.conf

   • Add the following configuration (adjust file paths and keys accordingly):

     ini

      

     [Interface] Address = 10.0.0.1/24 PrivateKey = <server-private-key> ListenPort = 51820 [Peer] PublicKey = <client-public-key> AllowedIPs = 10.0.0.2/32

   • Replace <server-private-key> with the private key you generated earlier for the server.

   • Replace <client-public-key> with the public key generated for your client.

2. Enable IP Forwarding

   • WireGuard requires IP forwarding to route traffic between the VPN and the internet. Enable it by running:

      

     sudo sysctl -w net.ipv4.ip_forward=1

   • To make this change permanent, edit the sysctl configuration:

      

     sudo nano /etc/sysctl.conf

   • Add or uncomment the following line:

      

     net.ipv4.ip_forward = 1

   • Apply the changes:

      

     sudo sysctl -p

Step 5: Set Up Firewall Rules

1. Allow WireGuard Port

   • Allow incoming traffic on the WireGuard port (51820 by default) through the firewall:
      

     sudo ufw allow 51820/udp

2. Configure NAT (Network Address Translation)

   • Set up NAT to forward VPN traffic to the internet:

      

     sudo ufw allow OpenSSH sudo ufw enable sudo ufw status

   • You need to add a NAT rule to allow the VPN clients to access the internet. First, open the UFW configuration file:

      

     sudo nano /etc/ufw/before.rules

   • Add the following lines before the filter section:

      

     *nat :POSTROUTING ACCEPT [0:0] -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE COMMIT

   • Reload the firewall:

      

     sudo ufw reload

Step 6: Start WireGuard Server

1. Start the WireGuard Interface

   • You can start the WireGuard interface with the following command:
      

     sudo wg-quick up wg0

2. Enable WireGuard to Start on Boot

   • To ensure that WireGuard starts automatically on boot, run:
      

     sudo systemctl enable wg-quick@wg0

3. Check the WireGuard Status

   • Verify that WireGuard is up and running by checking its status:
      

     sudo wg

Step 7: Configure the WireGuard Client

1. Create Client Configuration

   • Create a WireGuard configuration file for the client (wg0-client.conf). It should look something like this:

     ini

      

     [Interface] PrivateKey = <client-private-key> Address = 10.0.0.2/32 [Peer] PublicKey = <server-public-key> Endpoint = <server-ip>:51820 AllowedIPs = 0.0.0.0/0 PersistentKeepalive = 25

   • Replace <client-private-key> with the client’s private key, <server-public-key> with the server’s public key, and <server-ip> with the server’s public IP.

2. Transfer the Configuration File to the Client

   • Copy the client configuration file (wg0-client.conf) to the client machine using a secure method like SCP or SFTP.

3. Start WireGuard Client

   • On the client machine, you can bring up the VPN connection with:
      

     sudo wg-quick up wg0-client

4. Verify the VPN Connection

   • Once the client is connected, verify the connection by checking the WireGuard interface status on both the server and client:
      

     sudo wg

Step 8: Test the VPN Connection

1. Ping the VPN Server from the Client

   • To ensure the VPN is working correctly, try pinging the server from the client:
      

     ping 10.0.0.1

2. Test Internet Access

   • From the client, test your internet access by pinging an external website:

      

     ping google.com

   • If the ping is successful, your VPN is properly set up, and internet traffic is being routed through the WireGuard server.

Conclusion

WireGuard is a lightweight, secure, and fast VPN protocol that provides excellent performance for both personal and business use. By following the steps above, you’ve set up WireGuard on a VPS and created a secure private network. WireGuard is easy to configure and offers a modern alternative to traditional VPN protocols like OpenVPN and IPSec, making it an ideal choice for creating a private and secure network on your VPS.

You can expand this setup by adding more clients, setting up automatic IP address allocation, or further fine-tuning the firewall rules for advanced security.