Run Your Own WireGuard VPN Server on a VPS

Plan the network

This guide uses 10.8.0.0/24 for the VPN, with the server at 10.8.0.1 and clients from 10.8.0.2 upwards, and UDP port 51820. A Micro server handles a household or small team comfortably; WireGuard's throughput is usually limited by the network rather than the CPU.

1. Install WireGuard

sudo apt install -y wireguard qrencode           # Ubuntu / Debian
sudo dnf install -y wireguard-tools qrencode     # AlmaLinux / Rocky (qrencode from EPEL)

Because every VeloxMedia server is a full VMware virtual machine, the WireGuard kernel module is available without any host-side changes.

2. Generate server keys

sudo -i
cd /etc/wireguard && umask 077
wg genkey | tee server.key | wg pubkey > server.pub

3. Find the public interface

ip route get 1.1.1.1 | awk '{print $5; exit}'

It is usually eth0 or ens3; substitute it below.

4. Server configuration

Create /etc/wireguard/wg0.conf:

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <contents of server.key>
PostUp   = iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE; iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE; iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT

5. Enable forwarding and open the port

echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-wireguard.conf
sysctl --system
ufw allow 51820/udp                      # Ubuntu / Debian
firewall-cmd --permanent --add-port=51820/udp && firewall-cmd --permanent --add-masquerade && firewall-cmd --reload   # RHEL family

With UFW you also need to allow routed traffic: set DEFAULT_FORWARD_POLICY="ACCEPT" in /etc/default/ufw and run ufw reload.

6. Add a client

Generate a key pair for each device:

wg genkey | tee laptop.key | wg pubkey > laptop.pub

Append the client to the server configuration:

[Peer]
PublicKey = <contents of laptop.pub>
AllowedIPs = 10.8.0.2/32

Write the client's own configuration, laptop.conf:

[Interface]
PrivateKey = <contents of laptop.key>
Address = 10.8.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = <contents of server.pub>
Endpoint = 203.0.113.10:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

AllowedIPs = 0.0.0.0/0 sends all traffic through the VPN. To reach only the server and its private network, use 10.8.0.0/24 instead.

7. Start the VPN

systemctl enable --now wg-quick@wg0
wg show

Import laptop.conf into the WireGuard app on Windows, macOS or Linux. For a phone, show a QR code and scan it in the mobile app:

qrencode -t ansiutf8 < laptop.conf

Operating tips

• Give every device its own key so one can be revoked without touching the others.
• After adding a peer, apply it without dropping connections: wg syncconf wg0 <(wg-quick strip wg0).
• Delete client private keys from the server once they are installed on the device.
• Pick the region nearest to you for the lowest latency: London, Amsterdam, US East or US West.