How to Install WireGuard VPN on a VPS — Complete Guide [2026]

If you already have a VPS and want a private VPN that is fast, secure, and easy to set up, WireGuard is the best answer in 2026. Whether you need to protect traffic on public Wi-Fi, bypass geo-restrictions, or connect multiple private servers securely, this guide takes you through the entire process from zero to a working VPN on every device you own.

What Is WireGuard?

WireGuard is a modern VPN protocol designed to be faster, simpler, and more secure than older protocols like OpenVPN and IPsec. Key characteristics:

• Tiny codebase — approximately 4,000 lines of code (OpenVPN exceeds 100,000). Smaller code means easier security auditing and a much smaller attack surface.
• Runs in Linux kernel space — unlike userspace VPNs, WireGuard processes packets directly in the kernel, delivering throughput that significantly outpaces OpenVPN.
• Modern cryptography — Curve25519 for key exchange, ChaCha20 for encryption, Poly1305 for message authentication, BLAKE2 for hashing. All selected from the current state of the art.
• Perfect Forward Secrecy — session keys rotate with every handshake. Even if a private key is later compromised, past sessions remain protected.
• Cross-platform — Linux, Windows, macOS, iOS, Android, BSD.
• Free and open source — GPLv2 for the kernel component; no licensing fees.

WireGuard was merged into the Linux kernel in version 5.6 (April 2020). Any modern Linux VPS supports it out of the box — no extra kernel module required.

WireGuard vs OpenVPN vs IPsec/IKEv2

Factual comparison based on official documentation (data as of September 2026 — verify latest specs at each project's website):

WireGuard's main limitation is UDP-only transport. If a network strictly blocks all UDP traffic, WireGuard will not connect. In that edge case, OpenVPN over TCP 443 is the fallback.

Prerequisites

Server Side (VPS)

• A Linux VPS running Ubuntu 22.04 or 24.04 LTS (recommended) or Debian 11/12
• At least 512MB RAM — WireGuard is extremely lightweight
• SSH access with root or sudo privileges
• A public IP address (provided by every VPS host)

Client Side (Devices to Connect)

• Windows 10/11 — WireGuard installer from wireguard.com/install
• macOS — via Mac App Store or Homebrew
• iOS / Android — official apps on App Store and Google Play

Step 1: Install WireGuard on the Server

SSH into your VPS and run:

# Update package lists
sudo apt update && sudo apt upgrade -y

# Install WireGuard
sudo apt install -y wireguard wireguard-tools

# Verify installation
wg --version

A response like wireguard-tools v1.0.xx confirms a successful install. On Ubuntu 22.04/24.04, WireGuard is built into the kernel — no additional module is needed.

Step 2: Generate Server Key Pair

WireGuard uses public/private key cryptography, similar to SSH. Each peer (server and every client) needs its own key pair.

# Generate server private key
sudo wg genkey | sudo tee /etc/wireguard/server_private.key

# Derive the public key from the private key
sudo cat /etc/wireguard/server_private.key | sudo wg pubkey | sudo tee /etc/wireguard/server_public.key

# Restrict permissions
sudo chmod 600 /etc/wireguard/server_private.key

# Display keys (save the public key — you will need it in every client config)
echo "=== Server Private Key ===" && sudo cat /etc/wireguard/server_private.key
echo "=== Server Public Key ===" && sudo cat /etc/wireguard/server_public.key

Save the Server Public Key somewhere safe. It goes into every client configuration.

Step 3: Generate Client Key Pairs

Repeat for each device that will connect. Below creates keys for Client 1 (e.g., your laptop):

sudo wg genkey | sudo tee /etc/wireguard/client1_private.key
sudo cat /etc/wireguard/client1_private.key | sudo wg pubkey | sudo tee /etc/wireguard/client1_public.key
sudo chmod 600 /etc/wireguard/client1_private.key

echo "=== Client1 Private Key ===" && sudo cat /etc/wireguard/client1_private.key
echo "=== Client1 Public Key ===" && sudo cat /etc/wireguard/client1_public.key

Step 4: Write the Server Configuration

sudo nano /etc/wireguard/wg0.conf

Paste the following, replacing the placeholder values with your own keys:

[Interface]
# WireGuard network IP for the server
Address = 10.0.0.1/24

# Port WireGuard will listen on
ListenPort = 51820

# Paste your Server Private Key here
PrivateKey = <SERVER_PRIVATE_KEY>

# Full-tunnel NAT rules — routes all client traffic through this VPS
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

# ===== Peer: Client 1 =====
[Peer]
# Paste Client1 Public Key here
PublicKey = <CLIENT1_PUBLIC_KEY>

# VPN IP assigned to this client
AllowedIPs = 10.0.0.2/32

Step 5: Enable IP Forwarding and Configure Firewall

Enable IP Forwarding

# Enable immediately
sudo sysctl -w net.ipv4.ip_forward=1

# Persist across reboots
sudo sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/' /etc/sysctl.conf
sudo sysctl -p

Open the Firewall (UFW)

# Allow SSH — critical! Do this FIRST or you will lock yourself out
sudo ufw allow OpenSSH

# Allow the WireGuard UDP port
sudo ufw allow 51820/udp

# Enable UFW
sudo ufw --force enable

# Verify
sudo ufw status verbose

Start WireGuard

sudo wg-quick up wg0
sudo wg show

Step 6: Configure Client on Windows

1. Download the WireGuard Windows installer from wireguard.com/install and run it.
2. Open WireGuard → click "Add Tunnel" → "Add empty tunnel".
3. The app generates a key pair automatically — copy the Public Key shown, you need to add it to the server's [Peer] section.
4. Enter the following configuration:

[Interface]
# Auto-generated by the app
PrivateKey = <CLIENT_PRIVATE_KEY_FROM_APP>

# Client VPN IP
Address = 10.0.0.2/32

# DNS while connected
DNS = 1.1.1.1, 8.8.8.8

[Peer]
# Server Public Key from Step 2
PublicKey = <SERVER_PUBLIC_KEY>

# VPS public IP and WireGuard port
Endpoint = YOUR_VPS_IP:51820

# Full tunnel — all traffic routed through VPN
AllowedIPs = 0.0.0.0/0, ::/0

# Keepalive to maintain connection through NAT
PersistentKeepalive = 25

Click Save, then toggle Activate to connect.

Step 7: Configure Client on macOS

Option A — Mac App Store (recommended):

1. Open App Store → search "WireGuard" → install the official app.
2. Click "+" → "Add Empty Tunnel".
3. Use the same config structure as Windows, assigning a unique IP (e.g., 10.0.0.3/32).
4. Save and toggle to connect.

Option B — Homebrew (command line):

brew install wireguard-tools
sudo mkdir -p /etc/wireguard
sudo nano /etc/wireguard/wg0.conf
# Paste client config, then:
sudo wg-quick up wg0

Step 8: Configure Client on iOS and Android

iOS

1. Install "WireGuard" from the App Store.
2. Tap "+" → choose "Create from scratch" or "Create from QR code".
3. Assign IP 10.0.0.4/32 (or the next available address).

Android

1. Install "WireGuard" from Google Play.
2. Tap "+" → "Create from scratch".
3. Fill in the config with IP 10.0.0.4/32.

QR Code Method (Faster for Mobile)

# Install qrencode on the server
sudo apt install -y qrencode

# Create the mobile client config file
cat > /tmp/mobile_client.conf << EOF
[Interface]
PrivateKey = <MOBILE_CLIENT_PRIVATE_KEY>
Address = 10.0.0.4/32
DNS = 1.1.1.1

[Peer]
PublicKey = <SERVER_PUBLIC_KEY>
Endpoint = YOUR_VPS_IP:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25
EOF

# Display as QR code in terminal
qrencode -t ansiutf8 < /tmp/mobile_client.conf

Scan the QR code from the WireGuard app on your phone to import the tunnel instantly.

Step 9: Test the Connection

Check Your IP Address

With the VPN connected, visit whatismyipaddress.com — the displayed IP should be your VPS public IP, not your local network IP.

Verify on the Server

sudo wg show
# Look for "latest handshake: X seconds ago" under each peer
# That confirms the client connected and exchanged keys

Ping Test

# From client, ping the server WireGuard IP
ping 10.0.0.1

# From server, ping the client
ping 10.0.0.2

Step 10: Auto-Start WireGuard on Boot

# Enable the systemd service
sudo systemctl enable wg-quick@wg0

# Start it now
sudo systemctl start wg-quick@wg0

# Check status
sudo systemctl status wg-quick@wg0

WireGuard will now start automatically every time the VPS reboots — no manual intervention needed.

Troubleshooting Common Issues

Connection Timeout / No Handshake

• Verify UFW opened UDP 51820: sudo ufw status | grep 51820
• Check that your VPS provider's network firewall (Security Group / Firewall rules in the dashboard) also allows UDP 51820 — UFW alone is not enough if the provider has its own layer.
• Confirm the public key in the server [Peer] block matches the client's public key exactly.
• Confirm the Endpoint IP in the client config is the VPS public IP, not a private IP.

VPN Connects But No Internet (Full Tunnel)

• Verify IP forwarding is active: sysctl net.ipv4.ip_forward — should return 1.
• Check the interface name in PostUp/PostDown. Run ip link show to find the correct primary interface and replace eth0 if needed.
• Inspect NAT rules: sudo iptables -t nat -L -n — a MASQUERADE rule on the correct interface should be present.

DNS Leak

• Test at dnsleaktest.com.
• Fix by adding DNS = 1.1.1.1, 8.8.8.8 in the [Interface] section of your client config.

Add a New Peer Without Restarting

# Add live — existing connections are not dropped
sudo wg set wg0 peer <NEW_CLIENT_PUBLIC_KEY> allowed-ips 10.0.0.5/32

# Save to config file
sudo wg-quick save wg0

Frequently Asked Questions