Setting up a WireGuard VPN on your own server

WireGuard is a free, open-source VPN that has been built into the Linux kernel since 2020. On a Linux server of your own it takes a handful of commands and two short configuration files to give your laptop and phone an encrypted tunnel to that server. Beyond protecting you on public Wi-Fi, the tunnel lets you keep private services, such as a mail server's administration pages, reachable only by your own devices.

What WireGuard is

A VPN (virtual private network) creates an encrypted connection between two machines over the internet. Everything sent through it is unreadable to the networks in between.

WireGuard does this with a small, modern design:

• Modern cryptography. It uses the Noise protocol framework with Curve25519, ChaCha20-Poly1305 and BLAKE2s, and rotates its session keys every few minutes.
• A small codebase. Its Linux implementation is under 4,000 lines of code, which makes it practical to audit.
• Quiet by default. It does not answer packets from senders it does not recognise, so a scan of the server does not reveal it.
• Everywhere. It is in the Linux kernel since version 5.6, with clients for Windows, macOS, iOS, Android and the BSDs.

Each device in a WireGuard network is identified by a public key, much like an SSH key. Each side lists the other's public key and the addresses it may use, a setting called AllowedIPs, which acts as both the route and the access list.

What you need

• A Linux server with a public IP address and root access, such as a Noiz Cloud server running Ubuntu or Debian.
• The server already secured with SSH keys and a firewall. The usual first steps are SSH keys, a non-root user and a firewall that allows only what you use.
• The WireGuard app on each device you want to connect.

The set-up in outline

This is the shape of the job, so you know what is involved. Test each step before relying on it.

1. Install WireGuard

On Debian and Ubuntu:

sudo apt install wireguard

2. Create a key pair on the server and on each device

wg genkey | tee privatekey | wg pubkey > publickey

The private key never leaves the machine it was made on. Only public keys are exchanged. The phone and desktop apps generate their own keys for you.

3. Write the server's configuration

The server's file, /etc/wireguard/wg0.conf, names its own private key, its address inside the VPN and the port it listens on, then one [Peer] section per device:

[Interface]
PrivateKey = <server private key>
Address = 10.8.0.1/24
ListenPort = 51820

[Peer]
PublicKey = <laptop public key>
AllowedIPs = 10.8.0.2/32

Port 51820 is the usual choice, not a built-in default; WireGuard picks a random port if you do not set one.

4. Write each device's configuration

The device's file mirrors the server's: its own private key and address, then the server's public key, the server's public address and port as the endpoint, and the addresses to send through the tunnel. Setting AllowedIPs to the VPN range sends only VPN traffic through the tunnel; setting it to 0.0.0.0/0 sends everything, which is what you want on public Wi-Fi.

5. Open the port and start the tunnel

Allow the chosen UDP port in the server's firewall, then start WireGuard and enable it at boot:

sudo ufw allow 51820/udp
sudo systemctl enable --now wg-quick@wg0

If devices are to send all their traffic through the server, the server also needs IP forwarding switched on, in a file under /etc/sysctl.d/, and a NAT rule. On Debian 13 the old /etc/sysctl.conf file is no longer read.

Remember that a VPN runs both ways: a device on the VPN can reach the server, and the server can reach the device. Firewall the WireGuard interface as carefully as the public one.

Keeping a private mail server off the open internet

A VPN is most useful when it lets you close doors. A mail server has to keep port 25 open to receive mail from the rest of the world, but its administration pages, and even webmail and IMAP if your users are all on the VPN, need not be open to everyone.

Mailcow, the open-source mail server, runs in Docker. Its documentation warns that ordinary host firewall rules on the INPUT chain do not restrict it, because Docker manages its own rules, and that restrictions belong in the DOCKER-USER chain. Mailcow can also bind its services to a chosen IP address. Combined with WireGuard, that lets you make the administration interface answer only on the VPN. Mailcow documents these building blocks rather than a ready recipe, so plan and test the result.

When to use something else

• A firewall appliance. OPNsense, an open-source firewall, has included WireGuard since version 24.1, which suits an office that wants the VPN at the edge of its network.
• Many devices, changing often. headscale is an open-source, self-hosted coordination server for Tailscale clients, which manages keys and addresses across many devices for you.
• Policy. The UK National Cyber Security Centre prefers IPsec for enterprise VPNs and says WireGuard has yet to be proven in enterprise settings. For a small business or a single server, WireGuard's simplicity is a strength.
• No server to run. If you want an encrypted tunnel from each device without running anything yourself, the Noiz VPN add-on is set up and supported by Noiz, with nothing for you to configure.

Where Noiz fits

A Noiz Cloud server gives you the root access and Linux system WireGuard needs. If you would rather Noiz did the Linux side, Linux administration is quoted by the hour, once off or maintained monthly.

If you run a mail server and want its private pages reachable only from your own devices, get in touch.

Sources

• WireGuard: https://www.wireguard.com/
• WireGuard, protocol and cryptography: https://www.wireguard.com/protocol/
• WireGuard, quick start: https://www.wireguard.com/quickstart/
• WireGuard, installation: https://www.wireguard.com/install/
• WireGuard, known limitations: https://www.wireguard.com/known-limitations/
• WireGuard whitepaper: https://www.wireguard.com/papers/wireguard.pdf
• wg(8) manual page: https://manpages.debian.org/bookworm/wireguard-tools/wg.8.en.html
• wg-quick(8) manual page: https://manpages.debian.org/bookworm/wireguard-tools/wg-quick.8.en.html
• Ubuntu Server, introduction to WireGuard VPN: https://ubuntu.com/server/docs/explanation/intro-to/wireguard-vpn/
• Ubuntu Server, WireGuard VPN as the default gateway: https://ubuntu.com/server/docs/how-to/wireguard-vpn/vpn-as-the-default-gateway/
• Ubuntu Server, WireGuard security tips: https://ubuntu.com/server/docs/how-to/wireguard-vpn/security-tips/
• Debian 13 release notes, issues: https://www.debian.org/releases/trixie/release-notes/issues.html
• Mailcow, prerequisites and firewall: https://docs.mailcow.email/getstarted/prerequisite-system/
• Mailcow, IP bindings: https://docs.mailcow.email/post_installation/firststeps-ip_bindings/
• OPNsense 24.1 release notes: https://docs.opnsense.org/releases/CE_24.1.html
• headscale: https://github.com/juanfont/headscale
• NCSC, virtual private networks: https://www.ncsc.gov.uk/collection/device-security-guidance/infrastructure/virtual-private-networks

Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.