Why WireGuard?

In the world of self-hosting and VPS administration, VPN is one of the most fundamental and essential tools. Whether you’re protecting data transmission on public Wi-Fi, interconnecting private networks across regions, or setting up a home network exit proxy, VPN is indispensable infrastructure.

The mainstream VPN solutions include OpenVPN, WireGuard, and Tailscale. So what makes WireGuard special?

WireGuard vs OpenVPN vs Tailscale Comparison

WireGuard’s core advantage is minimalist design — it doesn’t pile on features, it focuses on doing one thing well: establishing an encrypted tunnel between two machines. Its codebase is just 1/1000th the size of OpenVPN, has passed multiple independent security audits, and has been proven secure.

For VPS users, WireGuard offers the best performance-to-complexity balance: more controllable than Tailscale (doesn’t rely on third-party relays), faster and lighter than OpenVPN.

Prerequisites

This guide assumes you have a VPS running one of the following:

• Ubuntu 22.04/24.04 LTS (recommended)
• Debian 11/12
• CentOS Stream 9 / Rocky Linux 9
• Alpine Linux

Plus a regular user with sudo privileges.

Method 1: Native WireGuard Installation (Recommended)

Step 1: Install WireGuard

Ubuntu/Debian:

sudo apt update
sudo apt install -y wireguard-tools resolvconf

CentOS/Rocky Linux:

# Kernel 5.6+ includes WireGuard module natively
sudo dnf install -y epel-release
sudo dnf install -y wireguard-tools

Alpine Linux:

sudo apk add wireguard-tools

Step 2: Generate Key Pairs

WireGuard uses asymmetric encryption — each device needs a key pair.

# Generate server key pair
wg genkey | tee /etc/wireguard/privatekey_server | wg pubkey > /etc/wireguard/publickey_server
chmod 600 /etc/wireguard/privatekey_server

# Generate client key pair (example: for a phone)
wg genkey | tee /etc/wireguard/privatekey_client | wg pubkey > /etc/wireguard/publickey_client
chmod 600 /etc/wireguard/privatekey_client

Security Note: Set key file permissions to 600 so only root can read them. In production, consider storing private keys securely and rotating them periodically.

Step 3: Create Server Configuration

Edit /etc/wireguard/wg0.conf:

[Interface]
# Server configuration
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = YOUR_SERVER_PRIVATE_KEY
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
SaveConfig = true

[Peer]
# First client (phone)
# Client public key = wg genkey | wg pubkey
AllowedIPs = 10.8.0.2/32
PublicKey = CLIENT_1_PUBLIC_KEY

[Peer]
# Second client (computer)
AllowedIPs = 10.8.0.3/32
PublicKey = CLIENT_2_PUBLIC_KEY

Key parameter explanations:

• Address: VPN subnet, server address is 10.8.0.1
• ListenPort: WireGuard listens on UDP port 51820 by default
• PostUp/PostDown: Automatically configures iptables rules to allow client traffic through the VPS (NAT forwarding)
• AllowedIPs: Specifies which IPs a client can access. /32 means only one IP assigned
• SaveConfig = true: Automatically saves the current connected peers list when the service stops

Step 4: Enable IP Forwarding

When WireGuard acts as a gateway, IP forwarding must be enabled:

# Temporarily enable
echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward

# Permanently: edit /etc/sysctl.conf
echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Step 5: Start and Enable WireGuard

sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0
sudo systemctl status wg-quick@wg0

Step 6: Configure Firewall

Ensure UDP port 51820 is accessible from outside:

# UFW (Ubuntu default firewall)
sudo ufw allow 51820/udp
sudo ufw reload

# firewalld (CentOS/RHEL)
sudo firewall-cmd --permanent --add-port=51820/udp
sudo firewall-cmd --reload

# Direct iptables configuration
sudo iptables -A INPUT -p udp --dport 51820 -j ACCEPT
sudo iptables-save | sudo tee /etc/iptables/rules.v4

Step 7: Verify Connection

# Check active connections
sudo wg

# View statistics
sudo wg show wg0 dump

# Test VPN connectivity
ping -c 3 10.8.0.1

Method 2: Docker Containerized Deployment

If you prefer container-based management, there’s a popular WireGuard Docker image available.

Create docker-compose.yml

version: '3.8'

services:
  wireguard:
    container_name: wireguard
    image: lscr.io/linuxserver/wireguard:latest
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Asia/Shanghai
      - SERVERURL=your-vps-ip  # Optional: dynamic DNS address
      - SERVERPORT=51820        # WireGuard listen port
      - PEERS=2                 # Number of clients
      - PEERDNS=auto
      - INTERNAL_SUBNET=10.8.0.0
      - ALLOWEDIPS=0.0.0.0/0    # All client traffic routed through VPN
    volumes:
      - ./config:/config
      - /lib/modules:/lib/modules
    ports:
      - 51820:51820/udp
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
    restart: unless-stopped

Start the Service

mkdir -p ./wireguard/config
docker compose up -d

The LinuxServer WireGuard image automatically generates key pairs and configuration files on first boot. Client configuration files are saved in ./config/peer1/peer1.conf.

View Client Configuration

cat ./wireguard/config/peer1/peer1.conf

The output can be directly imported into WireGuard clients.

Client Configuration

Linux Client

sudo apt install -y wireguard-tools

# Copy the .conf file provided by the server
sudo cp server.conf /etc/wireguard/wg0.conf

# Start connection
sudo wg-quick up wg0

# Verify
wg show

Windows Client

1. Download from WireGuard official site
2. Click “Add tunnel” → “Add tunnel from file”
3. Select the .conf file provided by the server
4. Click “Connect”

macOS Client

1. Install WireGuard from Mac App Store
2. Or via Homebrew: brew install --cask wireguard
3. Import the .conf configuration file

Android Client

1. Download from Google Play or F-Droid
2. Scan QR code or manually import the configuration file

iOS/iPadOS Client

1. Download the official app from App Store
2. Import the configuration file and connect

Advanced Configuration Tips

1. Full Traffic Proxy (All Traffic via VPN)

By default, clients can only access devices within the VPN subnet. If you want all traffic to go through the VPS proxy:

In the server configuration, modify the client’s AllowedIPs:

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 0.0.0.0/0   # All IPv4 traffic
    ::/0                  # All IPv6 traffic (optional)

Also ensure the server has IP forwarding and NAT enabled:

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o eth0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o eth0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

2. Split Tunneling

If you only want specific traffic through the VPN while other traffic uses the local network:

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.8.0.0/24, 192.168.1.0/24

This way, the client can only access 10.8.0.0/24 (VPN subnet) and 192.168.1.0/24 (local network) through the VPN, while other traffic goes through the local gateway.

3. Persistent Connections with Keep-Alive

WireGuard uses PersistentKeepalive to maintain connections behind NAT:

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.8.0.2/32
PersistentKeepalive = 25  # Send heartbeat every 25 seconds

This is especially useful for mobile devices (phones/laptops) — they can quickly re-establish connections when waking from sleep.

4. Multi-NIC VPS Scenarios

If your VPS has multiple network interfaces (e.g., eth0 public + eth1 internal), specify the outbound interface explicitly:

PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

5. Client Bandwidth Limiting

WireGuard itself doesn’t support rate limiting, but you can combine it with wondershaper:

sudo apt install -y wondershaper

# Limit wg0 interface speed (unit: kbps)
sudo wondershaper wg0 10000 50000  # Up 10Mbps, Down 50Mbps

Security Hardening

1. Restrict Client Access

Don’t blindly open all traffic. In production, it’s recommended to only allow clients to access necessary resources:

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.8.0.2/32  # Only allow VPN subnet access, no internet

If internet access is needed, pair with iptables whitelisting:

# Allow access only to specific IPs
sudo iptables -t nat -A POSTROUTING -o eth0 -s 10.8.0.0/24 -d 8.8.8.8 -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -o eth0 -s 10.8.0.0/24 -j MASQUERADE

2. Disable Unnecessary Ports

# Only open required WireGuard UDP port
sudo ufw default deny incoming
sudo ufw allow 22/tcp     # SSH
sudo ufw allow 51820/udp  # WireGuard
sudo ufw enable

3. Key Rotation

Regularly rotating keys enhances security:

# Generate new key pair
wg genkey | tee /tmp/new_privatekey | wg pubkey > /tmp/new_publickey

# Update public key in configuration file
# Restart WireGuard
sudo systemctl restart wg-quick@wg0

4. Monitor Connection Status

# Real-time connection monitoring
watch -n 5 'sudo wg show wg0 dump'

# Log connection events
sudo journalctl -u wg-quick@wg0 -f

Troubleshooting

Q1: Client connects but cannot access the internet

Cause: IP forwarding not enabled or NAT rules missing.

Solution:

# Check IP forwarding
cat /proc/sys/net/ipv4/ip_forward
# Should output 1

# Check NAT rules
sudo iptables -t nat -L POSTROUTING -v -n

# Manually add NAT rule
sudo iptables -t nat -A POSTROUTING -o eth0 -s 10.8.0.0/24 -j MASQUERADE

Q2: Connection drops frequently

Cause: NAT timeout or firewall rule conflicts.

Solution:

# Add PersistentKeepalive in client config
PersistentKeepalive = 25

# Check if firewall blocks UDP traffic
sudo iptables -L INPUT -v -n | grep 51820

Q3: Client gets an IP but can’t ping the server

Cause: Firewall blocking ICMP or WireGuard service not running properly.

Solution:

# Check service status
sudo systemctl status wg-quick@wg0

# Check if interface was created
ip addr show wg0

# Temporarily disable firewall for testing
sudo iptables -F INPUT

Q4: High battery drain on mobile devices

Cause: PersistentKeepalive set too low causing frequent wake-ups.

Solution:

# Increase heartbeat interval to 120 seconds or higher
PersistentKeepalive = 120

Q5: How to view real-time traffic per client?

# Show sent/received bytes for each Peer
sudo wg show wg0 transfer

# Example output:
# peer: xxxxxxxx..., allowed ips: 10.8.0.2/32, 
#       transmit: 1.23 GiB, received: 456.78 MiB

Performance Tuning

Adjust MTU Value

Default MTU is 1420, but it may need adjustment in some network environments:

# Add to Interface configuration
MTU = 1400  # Lower MTU for high-latency networks

Adjust Concurrent Connection Limits

# Increase maximum concurrent Peers (default: 4096)
echo "net.core.rmem_max = 134217728" | sudo tee -a /etc/sysctl.conf
echo "net.core.wmem_max = 134217728" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Use UDP-GSO (Linux 5.16+)

Newer kernels support UDP Generic Segmentation Offload, which can significantly improve throughput:

# Check if kernel supports it
grep -i gso /sys/module/wireguard/parameters/features

Summary

WireGuard is currently the best and lightest VPN solution available. Its minimalist design delivers exceptional performance and security, while being far simpler to configure than OpenVPN.

Key Takeaways:

1. Easy installation: One command to install, wg genkey to generate keys
2. Simple configuration: A single .conf file handles both server and client
3. Outstanding performance: Kernel-space implementation with low latency and high throughput
4. Secure and reliable: Independently audited multiple times with mature encryption algorithms
5. Cross-platform support: Full coverage for Linux, Windows, macOS, iOS, and Android

For VPS users, WireGuard is one of the most worthwhile self-hosting projects to invest in — it not only protects your network communications but also serves as infrastructure for cross-region networking, remote work, and home network exit proxies.

Next Steps:

• Install WireGuard on your VPS
• Generate key pairs and configure the server
• Import client configurations on each device
• Test connection speed and stability
• Adjust security policies and traffic routing as needed

Enjoy free, secure, and fast networking! 🔐