Run your own WireGuard VPN on a VPS

Why self-host?

A commercial VPN asks you to trust its no-logs claim. Your own WireGuard server means the only logs are the ones you choose to keep. A VPS S plan is plenty for a few devices, and you pick the exit country.

1. Install WireGuard

On a fresh Ubuntu 24.04 or Debian 12 VPS, install WireGuard and generate the server's key pair.

apt update && apt install -y wireguard qrencode
umask 077
wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub
wg genkey | tee /etc/wireguard/client.key | wg pubkey > /etc/wireguard/client.pub

2. Enable forwarding

Let the kernel route packets for your clients. Find your public interface name with `ip route | grep default` (often eth0 or ens3).

echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-wireguard.conf
sysctl --system

3. Write the server config

Create /etc/wireguard/wg0.conf. Replace eth0 if your interface is named differently, and paste in the keys you generated.

[Interface]
Address = 10.66.0.1/24
ListenPort = 51820
PrivateKey = <contents of server.key>
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = <contents of client.pub>
AllowedIPs = 10.66.0.2/32

4. Open the port and start it

If you use ufw, also set DEFAULT_FORWARD_POLICY="ACCEPT" in /etc/default/ufw so forwarded traffic isn't dropped.

ufw allow 51820/udp
systemctl enable --now wg-quick@wg0
wg show

5. Configure your device

Create a client config, then scan it as a QR code with the WireGuard mobile app or import the file on desktop.

[Interface]
PrivateKey = <contents of client.key>
Address = 10.66.0.2/32
DNS = 9.9.9.9

[Peer]
PublicKey = <contents of server.pub>
Endpoint = <your VPS IP>:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

# then: qrencode -t ansiutf8 < client.conf

Keep it private

WireGuard doesn't log connections by default. Keep it that way: don't add verbose logging, and set journald to a short retention period. Remember that the AUP still applies to traffic leaving your server.