How to Set Up Your Own WireGuard VPN Server (2026)

A commercial VPN means trusting a third party with your traffic. A self-hosted WireGuard VPN means you own the infrastructure. Your server, your keys, your logs (or lack thereof).

WireGuard is the default VPN protocol in 2026. It’s built into the Linux kernel, faster than OpenVPN, simpler to configure, and cryptographically sound. Mullvad deprecated OpenVPN entirely in January 2026 — that’s the direction the industry is moving.

This guide covers setting up your own WireGuard server on a Linux VPS, configuring clients across all platforms, and securing the setup for production use.

Why WireGuard Instead of a Commercial VPN?

The tradeoff: more setup work, more control. If you value ownership over convenience, WireGuard is the answer.

Prerequisites

• A Linux VPS (Ubuntu 26.04 LTS or Debian 13 recommended) — $5–10/month from providers like Hetzner, Linode, or DigitalOcean
• Domain name pointing to your VPS (optional but recommended for IP rotation flexibility)
• Basic familiarity with SSH and the Linux command line

Step 1: Set Up the Server

SSH into your VPS:

ssh root@your-server-ip

Install WireGuard

# Ubuntu / Debian
apt update && apt install -y wireguard

# Verify
wg --version
# WireGuard tools v1.0.20260223

Enable IP forwarding

echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
echo "net.ipv6.conf.all.forwarding = 1" >> /etc/sysctl.conf
sysctl -p

Step 2: Generate Keys

WireGuard uses Curve25519 key pairs. Generate a server key pair:

cd /etc/wireguard
umask 077
wg genkey | tee server.key | wg pubkey > server.pub

The umask 077 ensures only root can read the private key.

Step 3: Configure the Server

Create /etc/wireguard/wg0.conf:

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <server-private-key>

# Enable NAT for client traffic
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT
PostUp = iptables -A FORWARD -o wg0 -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT
PostDown = iptables -D FORWARD -o wg0 -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Replace <server-private-key> with the content of /etc/wireguard/server.key.

For the interface name (eth0), run ip route show default to check yours.

Enable and start WireGuard

systemctl enable wg-quick@wg0
systemctl start wg-quick@wg0

Check it’s running:

wg show
# interface: wg0
#   public key: <your-public-key>
#   listening port: 51820

Step 4: Generate a Client Configuration

Generate a client key pair

mkdir -p /etc/wireguard/clients
wg genkey | tee clients/laptop.key | wg pubkey > clients/laptop.pub

Add the client to the server config

Append to /etc/wireguard/wg0.conf:

[Peer]
# Laptop
PublicKey = <laptop-public-key>
AllowedIPs = 10.0.0.2/32

This assigns the laptop the IP 10.0.0.2 inside the VPN network.

Reload the server config

wg addconf wg0 <(wg-quick strip wg0)

Step 5: Create the Client Config File

Create a file to import into your client device:

[Interface]
PrivateKey = <laptop-private-key>
Address = 10.0.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = <server-public-key>
Endpoint = your-server-ip:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Explanation of each field:

• PrivateKey — the client’s private key (keep secret)
• Address — the client’s IP inside the VPN network
• DNS — DNS server to use while connected (Cloudflare’s 1.1.1.1 is privacy-respecting)
• PublicKey — your server’s public key (from server.pub)
• Endpoint — your server’s public IP and WireGuard port
• AllowedIPs = 0.0.0.0/0 — routes ALL traffic through the VPN (full tunnel)
• PersistentKeepalive = 25 — keeps the connection alive through NAT

Step 6: Connect Clients

macOS

1. Install WireGuard from the App Store or brew install wireguard-tools
2. Open WireGuard → Import tunnel(s) from file → Select the client config
3. Activate

Windows

WireGuard for Windows v0.6 (April 2026) is the latest:

1. Download from wireguard.com/install
2. Install → Import tunnel(s) → Select the client config
3. Activate

iOS / Android

1. Install the official WireGuard app from your app store
2. Tap + → Create from file or QR code
3. Scan/import the config
4. Connect

Step 7: Advanced: Kill Switch

A kill switch blocks all internet traffic if the VPN drops. Without it, your real IP leaks.

WireGuard’s built-in kill switch

Add to the [Interface] section of your client config:

Table = auto

WireGuard automatically removes the default route when the tunnel goes down. Test it:

# On Linux/macOS, with the VPN connected:
sudo wg-quick down wg0
# Internet should stop working until the tunnel reconnects

Firewall-based kill switch (Linux-only)

# Block all non-WireGuard outbound traffic when the VPN is active
iptables -I OUTPUT ! -o wg0 -m owner --uid-owner 0 -j REJECT

Step 8: Generate Configs for Multiple Clients

For your phone, tablet, work laptop — each device needs its own key pair and IP:

# Generate keys for each device
for device in phone tablet work-laptop; do
    wg genkey | tee clients/${device}.key | wg pubkey > clients/${device}.pub
done

Add each as a [Peer] in the server config with a unique IP (10.0.0.3, 10.0.0.4, etc.) and generate a matching client config file.

Security Checklist

• Server private key has 0600 permissions (chmod 600 /etc/wireguard/server.key)
• Firewall allows only port 51820/UDP from the internet
• SSH is locked down (key-only auth, no root login)
• VPS is fully updated (apt update && apt upgrade)
• DNS is set to a privacy-respecting provider (1.1.1.1 or 9.9.9.9)
• All client configs use PersistentKeepalive = 25
• You’ve tested the kill switch

Troubleshooting

VPN connects but no internet: Check IP forwarding is enabled (sysctl net.ipv4.ip_forward should return 1). Check the NAT rule on the server (iptables -t nat -L).

VPN drops frequently: Increase PersistentKeepalive to 25 in the client config. This sends keepalive packets every 25 seconds to maintain the NAT binding.

Slow speeds: WireGuard is kernel-level — speed issues are usually network path problems. Check your VPS’s bandwidth cap. Test with iperf3 between client and server.

“Handshake failed” error: Check the server’s firewall is allowing UDP on port 51820. Check the endpoint IP/hostname in the client config. Verify the public keys match.

Frequently Asked Questions

Is a self-hosted VPN really private?

More private than a commercial VPN because there’s no third-party logging. Your VPS provider can see encrypted traffic volume but not content. For maximum privacy, pay with cryptocurrency and use a provider that doesn’t require identity verification.

Can I route only specific traffic through WireGuard?

Yes. Change AllowedIPs = 0.0.0.0/0 to specific subnets. For example, AllowedIPs = 10.0.0.0/24 routes only the VPN network. Or use a split tunnel config.

Does WireGuard work with Docker?

Yes, but you need to expose the host network or use network_mode: host. WireGuard’s kernel module doesn’t work inside Docker containers directly.

How does WireGuard compare to Tailscale?

Tailscale is built on WireGuard but adds centralized coordination, ACLs, and NAT traversal via DERP relays. WireGuard is the raw protocol — more control, more setup. If you want zero-config, use Tailscale. If you want full ownership, roll your own WireGuard.

What version of WireGuard am I running?

wg --version
# wireguard-tools v1.0.20260223

What to Read Next

• Tor vs VPN: Which One Do You Actually Need? — When to use Tor, when to use a VPN, and when to use both
• Tor Bridges and Pluggable Transports — How to bypass censorship with obfs4, Snowflake, and WebTunnel
• What Is Tor? A Beginner’s Guide — How Tor works, key terms, and the dark web explained

Related Articles

Deepen your understanding with these curated continuations.

View All Articles

tor 5 min read

Tor vs VPN: Which One Do You Actually Need?

Tor and VPNs both protect your privacy, but they work very differently. Here's a clear comparison of when to use each, when to use both, and when neither is the right choice.

Vishnu May 30, 2026

tor 5 min read

How to Install Tor Browser: Step-by-Step Guide (2026)

Complete walkthrough for installing Tor Browser on Windows, macOS, Linux, and Android. Includes first-run configuration, bridge setup, security slider settings, and troubleshooting common issues.

Vishnu May 29, 2026

tor 5 min read

What Is Tor? The Onion Router Explained for Beginners

Tor is free software that bounces your internet traffic through three layers of encryption. Here's how it works, what the dark web actually is, key terms explained, and when you should — and shouldn't — use it.

Vishnu May 28, 2026