How to Self-Host a WireGuard VPN Server

What Is WireGuard?

WireGuard is a modern VPN protocol and its reference implementation in the Linux kernel was created by Jason A. Donenfeld and first published in 2016. Unlike OpenVPN (around 70,000 lines of code) and IPsec (even larger and more complex), WireGuard's kernel implementation is under 4,000 lines of code. This small footprint makes it far easier to audit, maintain, and verify for security vulnerabilities. In March 2020, WireGuard was merged into the Linux 5.6 kernel as a first-class citizen. On modern Linux, WireGuard requires no external daemon; the kernel module handles all cryptographic operations directly.

WireGuard uses a fixed, modern cryptographic suite with no algorithm negotiation:

WireGuard vs OpenVPN: Key Differences

What You Can Do with a Self-Hosted WireGuard VPN

The CGNAT Problem: Why Port Forwarding May Not Work for You

Traditional WireGuard server setup requires opening UDP port 51820 on your router (port forwarding) so that clients can connect from outside your home network. This works if your ISP gives you a real public IPv4 address. Many ISPs in 2026 do not.

CGNAT (Carrier Grade NAT) means your ISP places many customers behind a shared public IP address on their own NAT layer, before your home router. From the internet's perspective, your connection is invisible. You cannot port forward through the ISP's NAT layer because you do not control it. Even if you open every port on your home router, incoming connections are blocked by the ISP's NAT before they reach you.

There are three practical solutions for WireGuard behind CGNAT:

• Pay your ISP for a static public IP: Works, but costs money and is not available from all ISPs.
• Use a VPS as a relay: Configure a cheap cloud server as a WireGuard relay. Your home machine connects out to the VPS; clients connect to the VPS. Full control but requires server management.
• Localtonet UDP tunnel (simplest): Localtonet creates an outbound UDP tunnel that exposes your WireGuard port through a public endpoint without any inbound port opening required. This is the method covered in this guide.

Requirements

Step 1: Install WireGuard on the Server

WireGuard is included in the standard Linux kernel from version 5.6 onward. On Ubuntu 22.04 and 24.04, the wireguard package installs the userspace tools (wg and wg-quick) that manage the kernel module:

sudo apt update
sudo apt install -y wireguard wireguard-tools

Verify the kernel module and tools are available:

sudo modprobe wireguard
lsmod | grep wireguard

Expected output:

wireguard             118784  0
curve25519_x86_64      36864  1 wireguard
libchacha20poly1305    16384  1 wireguard
ip6_udp_tunnel         16384  1 wireguard
udp_tunnel             24576  1 wireguard

# Check wg-quick version:
wg --version

Expected output:

wireguard-tools v1.0.20210914 - https://git.zx2c4.com/wireguard-tools/

Step 2: Generate Server Keys

WireGuard uses public-key cryptography. Each peer (server and every client) has its own private key and a corresponding public key. The private key is never shared. The public key is what you add to the other side's configuration.

# Work inside the wireguard config directory:
cd /etc/wireguard

# Generate the server private key:
wg genkey | sudo tee server_private.key | wg pubkey | sudo tee server_public.key

# Set strict permissions on the private key:
sudo chmod 600 /etc/wireguard/server_private.key

# View the keys:
sudo cat /etc/wireguard/server_private.key
sudo cat /etc/wireguard/server_public.key

Expected output (your values will be different):

# server_private.key (example, never share this):
aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789ABCDEF=

# server_public.key (this is what clients need):
ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdef=

Step 3: Find Your Server's Network Interface Name

The WireGuard server's PostUp and PostDown rules must reference the actual name of your internet-facing network interface. This is typically eth0 on older Ubuntu systems but ens3, ens18, enp2s0, or similar on newer ones. Never assume eth0.

# Find the interface connected to the internet:
ip -o -4 route show to default | awk '{print $5}'

Expected output (example, yours may differ):

ens3

Note this name. You will use it in the PostUp and PostDown lines of the server config.

Step 4: Enable IP Forwarding

For WireGuard to route client traffic through the server (full-tunnel mode), the Linux kernel must be configured to forward packets between network interfaces. Without this, packets arriving on the wg0 interface cannot be sent out on ens3 toward the internet.

# Enable IPv4 forwarding immediately (does not persist across reboots):
sudo sysctl -w net.ipv4.ip_forward=1

# Make it permanent (persists across reboots):
echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/99-wireguard.conf
sudo sysctl -p /etc/sysctl.d/99-wireguard.conf

Verify it is active:

cat /proc/sys/net/ipv4/ip_forward

Expected output:

1

Step 5: Create the Server Configuration File

The WireGuard server configuration file lives at /etc/wireguard/wg0.conf. The interface name wg0 comes from the filename: wg-quick creates a network interface named after the config file. This file has an [Interface] section (the server itself) and one [Peer] section for each connected client.

sudo nano /etc/wireguard/wg0.conf

Paste the following, replacing values with your own:

[Interface]
# The private key of this server (from server_private.key):
PrivateKey = PASTE_SERVER_PRIVATE_KEY_HERE

# The VPN subnet IP address assigned to this server:
Address = 10.0.0.1/24

# WireGuard listens on this UDP port:
ListenPort = 51820

# Recommended MTU for WireGuard tunnels:
MTU = 1420

# Run when the interface comes up:
# Replace ens3 with your actual internet-facing interface name from Step 3
PostUp = iptables -A FORWARD -i %i -j ACCEPT
PostUp = iptables -A FORWARD -o %i -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE

# Run when the interface goes down (reverses the above rules):
PostDown = iptables -D FORWARD -i %i -j ACCEPT
PostDown = iptables -D FORWARD -o %i -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE

# Peer sections are added here as you add clients.
# Each client gets its own [Peer] block (see Step 6).

# Secure the config file:
sudo chmod 600 /etc/wireguard/wg0.conf

Step 6: Generate Client Keys and Add Peers

Each client (peer) needs its own key pair. You can generate keys on the server and transfer the config to the client, or generate them on the client device and only give the server the public key. The most common approach is generating everything on the server and then transferring the complete client config as a QR code or file.

Generate client keys

cd /etc/wireguard

# Generate keys for the first client (e.g., a phone):
wg genkey | sudo tee client1_private.key | wg pubkey | sudo tee client1_public.key
sudo chmod 600 /etc/wireguard/client1_private.key

# Optional but recommended: generate a preshared key for this peer pair:
wg genpsk | sudo tee client1_preshared.key
sudo chmod 600 /etc/wireguard/client1_preshared.key

Add the peer to the server config

sudo nano /etc/wireguard/wg0.conf

Add this block at the end of the file:

[Peer]
# Friendly comment to identify this peer:
# Phone - Alice

# The client's public key:
PublicKey = PASTE_CLIENT1_PUBLIC_KEY_HERE

# The preshared key (optional, provides post-quantum resistance):
PresharedKey = PASTE_CLIENT1_PRESHARED_KEY_HERE

# The VPN IP address(es) this client is allowed to use:
AllowedIPs = 10.0.0.2/32

Step 7: Create the Client Configuration File

Read each key value to create the client config:

# Read the values you need:
sudo cat /etc/wireguard/client1_private.key
sudo cat /etc/wireguard/server_public.key
sudo cat /etc/wireguard/client1_preshared.key

Create the client config file:

sudo nano /etc/wireguard/client1.conf

[Interface]
# The client's own private key:
PrivateKey = PASTE_CLIENT1_PRIVATE_KEY_HERE

# The VPN IP address assigned to this client:
Address = 10.0.0.2/32

# DNS server to use while VPN is active:
# Use the server's VPN IP (10.0.0.1) if Pi-hole or AdGuard runs on the server,
# or a public DNS like 1.1.1.1:
DNS = 1.1.1.1

# Recommended MTU for WireGuard tunnels:
MTU = 1420

[Peer]
# The server's public key:
PublicKey = PASTE_SERVER_PUBLIC_KEY_HERE

# The preshared key (must match the server's config for this client):
PresharedKey = PASTE_CLIENT1_PRESHARED_KEY_HERE

# Full-tunnel: route ALL traffic through VPN (0.0.0.0/0 = all IPv4, ::/0 = all IPv6):
AllowedIPs = 0.0.0.0/0, ::/0

# The server's public address and port.
# Replace with your actual public IP or domain / Localtonet address:
Endpoint = YOUR_SERVER_PUBLIC_IP:51820

# Send a keepalive packet every 25 seconds.
# Required when the client is behind NAT to keep the tunnel alive:
PersistentKeepalive = 25

Full Tunnel vs Split Tunnel: AllowedIPs Explained

The AllowedIPs field in a client's [Peer] block is the most important and most misunderstood setting in WireGuard. It serves two purposes simultaneously: it defines which destination IP ranges the client routes through the tunnel, AND it acts as an access control list determining which source IPs the server will accept packets from for this peer.

Step 8: Start WireGuard and Enable Autostart

# Bring the interface up:
sudo wg-quick up wg0

# Enable autostart on boot:
sudo systemctl enable wg-quick@wg0

Verify the interface is running:

sudo wg show

Expected output (before any clients connect):

interface: wg0
  public key: ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdef=
  private key: (hidden)
  listening port: 51820

peer: PASTE_CLIENT1_PUBLIC_KEY_HERE
  preshared key: (hidden)
  allowed ips: 10.0.0.2/32

# Check the interface is up in ip:
ip address show wg0

Expected output:

4: wg0:  mtu 1420 qdisc noqueue state UNKNOWN
    link/none
    inet 10.0.0.1/24 scope global wg0
       valid_lft forever preferred_lft forever

Step 9: Generate a QR Code for Mobile Clients

The WireGuard mobile apps for Android and iOS can import a client config by scanning a QR code. This is the easiest way to add clients without copying config files manually.

sudo apt install -y qrencode

# Generate the QR code for client1 (displays in terminal):
sudo qrencode -t ansiutf8 < /etc/wireguard/client1.conf

A QR code appears in the terminal. Open the WireGuard app on your phone, tap the + button, select Scan from QR Code, and scan the code. The full client configuration is embedded in the QR code.

Step 10: Adding More Clients

Each additional client needs its own key pair, a unique VPN IP address, and its own [Peer] block in the server config. Use sequential IPs: 10.0.0.2/32 for client 1, 10.0.0.3/32 for client 2, and so on.

cd /etc/wireguard

# Generate keys for client 2 (e.g., a laptop):
wg genkey | sudo tee client2_private.key | wg pubkey | sudo tee client2_public.key
sudo chmod 600 /etc/wireguard/client2_private.key
wg genpsk | sudo tee client2_preshared.key
sudo chmod 600 /etc/wireguard/client2_preshared.key

Add to /etc/wireguard/wg0.conf:

[Peer]
# Laptop - Bob
PublicKey = PASTE_CLIENT2_PUBLIC_KEY_HERE
PresharedKey = PASTE_CLIENT2_PRESHARED_KEY_HERE
AllowedIPs = 10.0.0.3/32

Apply the new peer without restarting WireGuard (no downtime for existing clients):

sudo wg addconf wg0 <(sudo wg-quick strip wg0)

Or simply reload the interface:

sudo wg-quick down wg0 && sudo wg-quick up wg0

Installation on Raspberry Pi

The Raspberry Pi is an excellent low-power WireGuard server. WireGuard is built into the Raspberry Pi OS kernel (Bookworm and later). The Raspberry Pi 4 and Pi 5 easily handle dozens of WireGuard peers. Even the Pi Zero 2W can run a personal WireGuard instance with minimal load.

# Install on Raspberry Pi OS (Bookworm):
sudo apt update
sudo apt install -y wireguard wireguard-tools

# Verify the module:
lsmod | grep wireguard

All the configuration steps above (key generation, wg0.conf, PostUp/PostDown, IP forwarding) are identical on Raspberry Pi OS. The only common difference is the network interface name: Raspberry Pi connected via Ethernet typically uses eth0; via Wi-Fi it uses wlan0. Confirm with:

ip -o -4 route show to default | awk '{print $5}'

Connecting Clients: All Platforms

sudo apt install wireguard
sudo cp client1.conf /etc/wireguard/wg0.conf
sudo wg-quick up wg0
sudo systemctl enable wg-quick@wg0

Exposing WireGuard Behind CGNAT with Localtonet UDP Tunnel

If you are behind CGNAT or cannot open UDP port 51820 on your router, Localtonet's native UDP tunnel gives your WireGuard server a public UDP endpoint that clients can connect to from anywhere. WireGuard clients point their Endpoint to the Localtonet address instead of your home IP.

# Linux / Raspberry Pi OS:
curl -fsSL https://localtonet.com/install.sh | sh

# Verify:
localtonet --version

localtonet --authtoken YOUR_TOKEN_HERE

# Change from:
Endpoint = YOUR_HOME_IP:51820

# To (use the address and port from the Localtonet dashboard):
Endpoint = tunnel.localto.net:XXXXX

sudo localtonet --install-service --authtoken YOUR_TOKEN_HERE
sudo localtonet --start-service --authtoken YOUR_TOKEN_HERE

Monitoring and Diagnostics: wg show

The wg show command is the primary diagnostic tool for WireGuard. It shows the state of all interfaces and peers, including the most recent handshake time, transferred bytes, and the endpoint address the server last saw each client connect from.

sudo wg show

Expected output after a client connects:

interface: wg0
  public key: ABCDEFGHIJKLMNOPQRSTUVWXYZ=
  private key: (hidden)
  listening port: 51820

peer: CLIENT1_PUBLIC_KEY=
  preshared key: (hidden)
  endpoint: 203.0.113.45:54321
  allowed ips: 10.0.0.2/32
  latest handshake: 42 seconds ago
  transfer: 1.24 MiB received, 8.75 MiB sent

Key fields to check when troubleshooting:

Troubleshooting

Frequently Asked Questions