How to Create Your Own VPN Server with WireGuard on an Ubuntu VPS

Commercial VPN services are convenient, but they ask you to trust a company you know little about with all of your internet traffic. If you’d rather control the server yourself, you can build your own VPN in about 20 minutes for a few dollars a month.

This guide shows you how to set up WireGuard, a modern, fast, and secure VPN protocol, on an Ubuntu VPS (virtual private server). You’ll then connect your laptop and phone to it.

What Is WireGuard?

WireGuard is an open-source VPN protocol created by security researcher Jason A. Donenfeld. It was merged into the mainline Linux kernel in version 5.6 (March 2020), and it has become the preferred protocol for many VPN providers and IT teams.

Why people choose WireGuard:

• Simple and auditable: its codebase is a small fraction of the size of OpenVPN or IPsec, which makes it easier to review for security flaws.
• Modern cryptography: it uses Curve25519, ChaCha20, Poly1305, and BLAKE2s, built on the Noise protocol framework.
• Fast: it runs in the kernel and typically delivers lower latency and higher throughput than older protocols.
• Roams well: connections survive switching from Wi-Fi to cellular.
• Cross-platform: official apps exist for Windows, macOS, Linux, iOS, and Android.

WireGuard vs. OpenVPN vs. IPsec

Self-Hosted VPN vs. Commercial VPN

Before you start, know what a personal VPN does and doesn’t do.

A self-hosted VPN is great for:

• Securing your traffic on public Wi-Fi (airports, hotels, coffee shops)
• Keeping control of your data, with no third-party VPN company involved
• Giving you a stable, dedicated IP address
• Reaching your servers or home lab securely

It is not designed for:

• Anonymity. The VPS is rented in your name, and all traffic leaves from one IP linked to you.
• Switching countries on demand. You get one location per server.
• Streaming workarounds. Many streaming services block data center IP addresses.

What You’ll Need

• An Ubuntu VPS. Ubuntu 24.04 LTS is recommended; 22.04 LTS also works. Entry-level plans from providers like DigitalOcean, Akamai (Linode), Vultr, or Hetzner typically cost around 4–4–6 per month. 1 vCPU and 1 GB of RAM is plenty.
• SSH access to the server with a user that has sudo privileges.
• The WireGuard app on each device you want to connect (from wireguard.com/install).
• About 20 minutes.

💡 Tip: choose a data center close to you, such as New York, Dallas, or San Francisco, for the lowest latency.

Step 1: Update Your Server

Connect to your VPS over SSH:

ssh your_user@YOUR_SERVER_IP

Then update the system:

sudo apt update && sudo apt upgrade -y

Step 2: Install WireGuard

The WireGuard kernel module is already built into Ubuntu’s kernel, so you only need the user-space tools:

sudo apt install wireguard -y

Confirm the installation:

wg --version

Step 3: Generate the Server Keys

WireGuard uses public/private key pairs, similar to SSH. Generate the server’s keys with secure permissions:

umask 077
wg genkey | sudo tee /etc/wireguard/server_private.key | wg pubkey | sudo tee /etc/wireguard/server_public.key

View the keys when you need them:

sudo cat /etc/wireguard/server_private.key
sudo cat /etc/wireguard/server_public.key

🔒 Never share your private key. Only public keys are exchanged between the server and clients.

Step 4: Find Your Network Interface Name

You’ll need the name of the server’s public network interface:

ip route list default

The output looks like this:

default via 203.0.113.1 dev eth0 proto static

The name after dev is your interface. It is often eth0, ens3, or enp1s0. Replace eth0 in the next step if yours is different.

Step 5: Create the Server Configuration

Create the WireGuard configuration file:

sudo nano /etc/wireguard/wg0.conf

Paste the following, replacing SERVER_PRIVATE_KEY with your key and eth0 with your interface name:

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY

PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

What each line does:

• Address: the server’s private IP address inside the VPN (10.8.0.1).
• ListenPort: the UDP port WireGuard listens on. 51820 is the default.
• PrivateKey: the server’s private key.
• PostUp / PostDown: firewall rules that forward VPN traffic and apply NAT (masquerading), so clients can reach the internet through the server.

Save and exit: press Ctrl + O, then Enter, then Ctrl + X.

Step 6: Enable IP Forwarding

By default, Linux won’t route traffic between network interfaces. Turn on IPv4 forwarding:

echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-wireguard.conf
sudo sysctl --system

Confirm it worked:

sysctl net.ipv4.ip_forward

The output should be net.ipv4.ip_forward = 1.

Step 7: Configure the Firewall

Allow SSH first, so you don’t lock yourself out, then open WireGuard’s port:

sudo ufw allow OpenSSH
sudo ufw allow 51820/udp
sudo ufw enable
sudo ufw status

⚠️ Cloud firewall check: many VPS providers, including DigitalOcean, AWS, and Vultr, also have a firewall in their web dashboard. If you use one, make sure UDP port 51820 is open there too.

Step 8: Start WireGuard

Start the VPN and make it launch automatically at boot:

sudo systemctl enable --now wg-quick@wg0

Check its status:

sudo wg show

You should see the wg0 interface, its public key, and the listening port.

Step 9: Create a Client Configuration

Each device (laptop, phone, tablet) needs its own key pair and its own VPN IP address.

Generate the Client Keys

On the server, run:

umask 077
wg genkey | tee ~/client1_private.key | wg pubkey > ~/client1_public.key

Add the Client to the Server

Open the server configuration again:

sudo nano /etc/wireguard/wg0.conf

Add this block at the end, replacing the placeholder with the contents of client1_public.key:

[Peer]
# Client 1 - Laptop
PublicKey = CLIENT1_PUBLIC_KEY
AllowedIPs = 10.8.0.2/32

Restart WireGuard to apply the change:

sudo systemctl restart wg-quick@wg0

Create the Client Config File

Create a file named client1.conf:

nano ~/client1.conf

Paste the following, replacing the placeholders:

[Interface]
PrivateKey = CLIENT1_PRIVATE_KEY
Address = 10.8.0.2/32
DNS = 1.1.1.1, 1.0.0.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = YOUR_SERVER_IP:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

Key settings explained:

• DNS: Cloudflare’s resolvers (1.1.1.1). You can use Quad9 (9.9.9.9) or another trusted provider instead.
• AllowedIPs = 0.0.0.0/0, ::/0: sends all traffic through the VPN (a “full tunnel”). Including ::/0 also prevents IPv6 traffic from leaking outside the tunnel.
• PersistentKeepalive = 25: keeps the connection alive behind home routers and NAT.

💡 Split tunnel option: to send only VPN-network traffic through the tunnel, use AllowedIPs = 10.8.0.0/24.

Step 10: Connect Your Devices

On a Phone (iOS or Android): Scan a QR Code

Install qrencode on the server and display the config as a QR code:

sudo apt install qrencode -y
qrencode -t ansiutf8 < ~/client1.conf

In the WireGuard mobile app, tap +, choose Create from QR code, and scan the code shown in your terminal.

💡 Generate a separate client (client2, IP 10.8.0.3) for your phone rather than reusing your laptop’s keys.

On Windows or macOS

1. Copy client1.conf securely to your computer, for example with scp: scp your_user@YOUR_SERVER_IP:~/client1.conf .
2. Open the WireGuard app and click Import tunnel(s) from file.
3. Select the file and click Activate.

On Linux

sudo apt install wireguard -y
sudo cp client1.conf /etc/wireguard/wg0.conf
sudo wg-quick up wg0

After importing the config, delete the client private key files from the server:

rm ~/client1_private.key ~/client1.conf

Step 11: Test Your VPN

With the VPN connected:

1. Check your public IP: visit a site like ifconfig.me or run curl ifconfig.me. It should show your server’s IP.
2. Check for DNS leaks: run the extended test at dnsleaktest.com.
3. Confirm the handshake on the server: sudo wg show A recent “latest handshake” time means the client is connected.

Adding More Devices

For each new device:

1. Generate a new key pair.
2. Assign the next IP address (10.8.0.3, 10.8.0.4, and so on).
3. Add a new [Peer] block to /etc/wireguard/wg0.conf.
4. Restart WireGuard with sudo systemctl restart wg-quick@wg0.

Troubleshooting Common Problems

Useful logs and diagnostics:

sudo systemctl status wg-quick@wg0
sudo journalctl -u wg-quick@wg0

Security Best Practices

Your VPN is only as secure as the server it runs on:

• Use SSH keys and disable password login in /etc/ssh/sshd_config by setting PasswordAuthentication no.
• Enable automatic security updates: sudo apt install unattended-upgrades -y sudo dpkg-reconfigure --priority=low unattended-upgrades
• Use one key pair per device. If a device is lost, remove its [Peer] block and restart WireGuard.
• Protect private keys. Keep file permissions restricted (chmod 600) and never share them over email or chat.
• Review your VPS provider’s terms of service. Running a personal VPN is legal in the U.S. and generally permitted, but abusive traffic can get your account suspended.

Frequently Asked Questions

Is it legal to run my own VPN in the United States? Yes. Using and hosting a VPN is legal in the U.S. You remain responsible for what you do online.

How much does a self-hosted WireGuard VPN cost? Usually the price of a small VPS, around $4\text{–}$4–6 per month. WireGuard itself is free.

Is WireGuard secure? Yes. WireGuard uses modern, well-reviewed cryptography and has a small, auditable codebase. It is included in the official Linux kernel.

Can I use WireGuard on multiple devices? Yes. Create a separate key pair and VPN IP address for each device.

Will a self-hosted VPN make me anonymous? No. It encrypts your traffic and hides it from local networks, but the VPS is tied to your identity and payment information.

Does WireGuard work on Ubuntu 22.04? Yes. The steps in this guide work on both Ubuntu 22.04 LTS and 24.04 LTS.

Bottom Line

Running your own WireGuard VPN gives you a fast, private, and fully controlled connection for the price of a cup of coffee each month. The setup takes about 20 minutes, the protocol is among the most secure available, and you never have to wonder what a third-party VPN company is doing with your data. If you want privacy on public Wi-Fi without trusting someone else’s server, WireGuard on an Ubuntu VPS is one of the best options available.

Sources

1. WireGuard official website: wireguard.com
2. WireGuard Quick Start: wireguard.com/quickstart
3. WireGuard installation (official clients): wireguard.com/install
4. WireGuard whitepaper (Jason A. Donenfeld): wireguard.com/papers/wireguard.pdf
5. Ubuntu Server documentation, WireGuard VPN: documentation.ubuntu.com/server/how-to/wireguard-vpn
6. wg(8) and wg-quick(8) manual pages: manpages.ubuntu.com
7. Linux 5.6 release notes (WireGuard merged into the kernel): kernelnewbies.org/Linux_5.6
8. Ubuntu UFW documentation: help.ubuntu.com/community/UFW
9. Ubuntu automatic security updates: documentation.ubuntu.com/server/how-to/software/automatic-updates