WireGuard VPN Server Setup on Ubuntu 24.04

With a commercial VPN you share one IP address with hundreds or thousands of strangers, and you have to trust a company you know little about with all of your traffic. Running your own VPN server fixes both problems: the IP address is yours alone, and so are the keys. In this guide we will do a complete WireGuard VPN server setup on Ubuntu 24.04, configure the firewall properly and connect a laptop and a phone. If you copy the commands as you go, expect about 15–20 minutes.

What is WireGuard and why use it?

WireGuard is a modern VPN protocol that ships inside the Linux kernel. Compared with OpenVPN or IPsec it has a tiny codebase, a configuration that fits on one screen, and excellent performance even on small servers. It runs over UDP, and every device is identified by a key pair (private/public) instead of a username and password.

Typical reasons to run your own VPN server:

• Encrypting traffic on public Wi-Fi. In cafés, hotels or airports your traffic travels encrypted all the way to your server.
• A fixed IP for remote administration. You can restrict SSH or admin panels on your other servers to your VPN's IP address (IP allowlisting).
• Reaching home or office services. Access services on a private network through the tunnel instead of exposing them to the internet.

VPN rules differ between countries. It is your responsibility to follow the laws where you are and your hosting provider's terms of service.

Before you start

• A VPS running Ubuntu 24.04 with root (or sudo) access. If you are new to remote access, read our SSH guide first.
• The server needs its own public IPv4 address, and the UDP port you choose (51820 in this guide) must be reachable from the internet. At TürkiyeVPS, plans that list 1 dedicated IPv4 address in their features, such as our VDS Enterprise plans, meet this requirement. The standard VPS and VDS plans do not list a separate public IPv4 address, so if you are thinking of running WireGuard on one of them, check with our support team first.
• If you have not hardened the server yet, work through our Linux server security checklist first.

1. Install WireGuard

sudo apt update
sudo apt install -y wireguard qrencode

The wireguard package provides the wg and wg-quick tools; qrencode will generate a QR code for your phone.

2. Generate the keys

Create key pairs for the server and for the first client (for example, your laptop). umask 077 makes the new files readable by root only:

sudo -i
cd /etc/wireguard
umask 077
wg genkey | tee server.key | wg pubkey > server.pub
wg genkey | tee client1.key | wg pubkey > client1.pub

Never share the private keys (.key). The public keys (.pub) go into the other side's configuration.

3. Find your public network interface

The NAT rule needs the name of the interface your server uses to reach the internet. It is not always eth0:

ip route show default

If the output looks like default via 203.0.113.1 dev ens3 ..., your interface is ens3. Replace eth0 in the examples below with your own interface name.

4. Server configuration: wg0.conf

nano /etc/wireguard/wg0.conf

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# client1 - laptop
PublicKey = CLIENT1_PUBLIC_KEY
AllowedIPs = 10.8.0.2/32

Paste the output of cat server.key in place of SERVER_PRIVATE_KEY and cat client1.pub in place of CLIENT1_PUBLIC_KEY. 10.8.0.0/24 is the private network inside the tunnel: the server is 10.8.0.1 and the first client is 10.8.0.2.

5. Enable IP forwarding

To pass client traffic on to the internet, the kernel must forward IPv4 packets:

echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/99-wireguard.conf
sysctl --system

Check it with sysctl net.ipv4.ip_forward — the result should be = 1.

6. Firewall (UFW)

If you use UFW, you need to allow both the WireGuard port and forwarding from the tunnel to the internet. Do not enable UFW before allowing SSH, or you will lock yourself out:

ufw allow OpenSSH
ufw allow 51820/udp
ufw route allow in on wg0 out on eth0
ufw enable
ufw status verbose

The ufw route allow rule permits forwarded traffic only from wg0 to your public interface. You could instead set DEFAULT_FORWARD_POLICY="ACCEPT" in /etc/default/ufw, but that opens all forwarding; the route rule is the tighter option.

7. Start WireGuard

systemctl enable --now wg-quick@wg0
wg show

wg show should list interface: wg0, the listening port and your peer. Thanks to enable, the tunnel comes back automatically after a reboot.

8. Client configuration

The easiest approach is to write the client file on the server and then move it to the device:

nano /etc/wireguard/client1.conf

[Interface]
PrivateKey = CLIENT1_PRIVATE_KEY
Address = 10.8.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = SERVER_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

• AllowedIPs = 0.0.0.0/0 sends all IPv4 traffic through the tunnel. If you only want to reach the VPN network itself, use 10.8.0.0/24 (split tunnel).
• IPv6 note: if you have not configured IPv6 inside the tunnel, IPv6 traffic may bypass it. Adding , ::/0 to AllowedIPs routes IPv6 into the tunnel; without IPv6 on the server side it simply will not work, but it will not leak either.
• PersistentKeepalive = 25 keeps the connection alive for devices behind NAT, such as mobile data or a home router.

Desktop: install the official WireGuard client (Windows, macOS, Linux) and import client1.conf. Use scp to copy the file securely from the server.

Phone: in the WireGuard app choose "Create from QR code". This command draws a QR code right in your terminal:

qrencode -t ansiutf8 < /etc/wireguard/client1.conf

Once connected, any "what is my IP" page should show your VPS's IP address.

9. Adding more devices

Give every device its own key pair and its own tunnel IP. For a second client (say, a phone on 10.8.0.3):

cd /etc/wireguard
umask 077
wg genkey | tee client2.key | wg pubkey > client2.pub

Quick way (live only):

wg set wg0 peer "$(cat client2.pub)" allowed-ips 10.8.0.3/32

This adds the peer instantly, but it is lost on restart. To make it permanent, add a new [Peer] block to wg0.conf and reload without dropping existing sessions:

wg syncconf wg0 <(wg-quick strip wg0)

Lost a device? Delete its [Peer] block and run the same reload command — that key can no longer connect.

Troubleshooting

• Connected but no internet: check sysctl net.ipv4.ip_forward, the interface name in PostUp, and the ufw route rule.
• No handshake at all: if wg show never shows a "latest handshake", UDP 51820 is probably blocked or the keys are swapped. The server's PublicKey must be the client's public key, and vice versa.
• Logs: journalctl -u wg-quick@wg0 shows start-up errors.

Frequently Asked Questions

WireGuard or OpenVPN?

WireGuard is newer, faster and simpler to configure, which makes it a good default for personal use. OpenVPN can run over TCP and has been around much longer, so some corporate environments still prefer it.

How big does my VPN server need to be?

WireGuard is very lightweight. For a handful of personal devices, 1 vCPU and 512 MB of RAM are usually enough. What matters more than CPU is that the server has its own public IP address and a good network connection.

I don't want to set it up myself. Is there a ready-made option?

Yes. With TürkiyeVPS VPN server plans WireGuard or OpenVPN is set up automatically after payment, you get a dedicated IP address and you download your connection file from the client panel.

Your own VPN server in Istanbul, Turkey

Prefer to do it yourself? Our VDS Enterprise plans come with 1 dedicated IPv4 address, root access and unlimited traffic. Payment is accepted in USDT (TRC20). If you would rather have a ready-to-use WireGuard server with its own IP, take a look at our VPN server plans, from $1.79/month; it is set up automatically after payment. Questions? Reach us via live chat on the site or open a support ticket in the customer panel.