WireGuard VPN on Ubuntu

1. Install

sudo apt update
sudo apt install wireguard

2. Generate server keys

umask 077
wg genkey | tee server.key | wg pubkey > server.pub

Keep private keys secret. Generate a separate key pair on each client.

3. Server configuration

Create /etc/wireguard/wg0.conf (replace placeholders):

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.8.0.2/32

4. Enable and inspect

sudo chmod 600 /etc/wireguard/wg0.conf
sudo systemctl enable --now wg-quick@wg0
sudo wg show

Allow UDP 51820 through the firewall. For internet routing, enable IP forwarding and configure NAT for your actual network interface; for private subnet access, configure appropriate routes instead.

5. Client example

[Interface]
PrivateKey = CLIENT_PRIVATE_KEY
Address = 10.8.0.2/32

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = vpn.example.com:51820
AllowedIPs = 10.8.0.0/24
PersistentKeepalive = 25

Use AllowedIPs = 0.0.0.0/0, ::/0 only when full-tunnel routing and IPv6 are deliberately configured. Test connectivity to 10.8.0.1 and verify handshake with wg show.