Alex designs and hardens EU VPS fleets in Frankfurt and Amsterdam. He spends most days on Docker, KVM networking, NVMe layouts, and keeping Ubuntu 24.04 boxes boringly reliable for production workloads.
Why WireGuard on a VPS
WireGuard is a lean kernel VPN. On a European VPS it becomes a private on-ramp to your lab, a fixed egress IP for travel, or a mesh between home and cloud.
OrbitHost KVM plans in Frankfurt and Amsterdam give you a stable public IP and enough CPU for crypto without noticing. One vCPU and 1 GB RAM is plenty for personal use.
Install WireGuard tools
Ubuntu 24.04 ships WireGuard in the default repos. Install `wireguard` and `wireguard-tools`, then enable IPv4 forwarding so clients can reach the internet through the VPS.
sudo apt update
sudo apt install -y wireguard wireguard-tools qrencode
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-wireguard.conf
sudo sysctl --systemGenerate server and client keys
Each peer needs a private/public keypair. Keep private keys mode 600 under `/etc/wireguard`. Never paste private keys into tickets or chat.
Generate one server pair and one client pair for the first laptop. Add more clients later with unique tunnel IPs from the same subnet.
umask 077
wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key
wg genkey | tee /etc/wireguard/client1_private.key | wg pubkey > /etc/wireguard/client1_public.key
sudo chmod 600 /etc/wireguard/*_private.keyCreate /etc/wireguard/wg0.conf
Pick a tunnel subnet that does not collide with home LAN ranges — `10.8.0.0/24` is common. The server gets `.1`, first client `.2`.
Set `PostUp`/`PostDown` iptables (or nft) MASQUERADE on the public interface. Replace `eth0` with your actual NIC from `ip -br a`.
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY_HERE
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
[Peer]
# client1 laptop
PublicKey = CLIENT1_PUBLIC_KEY_HERE
AllowedIPs = 10.8.0.2/32Open the firewall and start wg-quick
Allow UDP 51820 (or your chosen port) and enable the interface. `wg show` should list the listening port and peer public key even before the client connects.
sudo ufw allow 51820/udp
sudo ufw allow OpenSSH
sudo ufw enable
sudo systemctl enable --now wg-quick@wg0
sudo wg showClient configuration
On the client, install WireGuard and import a config that points `Endpoint` at your VPS public IP. `AllowedIPs = 0.0.0.0/0` full-tunnels all traffic; use `10.8.0.0/24` for split tunnel into the VPN LAN only.
Mobile clients can scan a QR code generated with `qrencode` from the client config file — handy for phones without awkward key pasting.
[Interface]
PrivateKey = CLIENT1_PRIVATE_KEY_HERE
Address = 10.8.0.2/24
DNS = 1.1.1.1
[Peer]
PublicKey = SERVER_PUBLIC_KEY_HERE
Endpoint = YOUR_VPS_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25Verify and harden
From the client, ping `10.8.0.1` and check `curl ifconfig.me` matches the VPS IP when full-tunnel is on. If ICMP works but internet does not, revisit forwarding and MASQUERADE interface names.
Rotate keys if a laptop is lost. Keep SSH on a key-only policy even with VPN — defense in depth. For censorship-heavy paths, compare with our V2Ray guide; for simple private access, WireGuard stays the cleanest default on `/vps-for-wireguard` sized boxes.
Related products
FAQ
Which UDP port should WireGuard use?
51820/udp is the common default. You can pick any free UDP port — just open it in UFW and match `ListenPort` in wg0.conf and every client.
Do I need a dedicated IP?
A public IPv4 on the VPS is enough. Clients connect to that address. IPv6 works too if your VPS and clients both support it end-to-end.
WireGuard vs commercial VPN apps?
Self-hosted WireGuard gives you the exit IP of your VPS and full control of peers. You manage keys and updates; there is no app store subscription layer.
Can I run WireGuard inside Docker?
Yes, but bare-metal/`wg-quick` on the VPS is simpler for a single tunnel. Docker needs NET_ADMIN and careful sysctl passthrough.