How to Configure Ubuntu Server as a VPN Gateway using WireGuard

If you need to access your home network or corporate servers securely from a public coffee shop Wi-Fi, a Virtual Private Network (VPN) is essential. Historically, setting up OpenVPN or IPsec was a complex, fragile process. WireGuard has revolutionized this by offering state-of-the-art cryptography in a tiny, incredibly fast, and easy-to-configure package integrated directly into the Linux kernel.

Step 1: Install WireGuard

WireGuard is available in the default Ubuntu repositories. Connect to your server via SSH and run:

sudo apt update && sudo apt install wireguard

Step 2: Generate Cryptographic Keys

WireGuard relies on public/private key pairs, similar to SSH. You need to generate a pair for the server.

1. Navigate to the WireGuard directory:
   cd /etc/wireguard
2. Set restrictive permissions so only root can read the keys:
   umask 077
3. Generate the private and public keys:
   wg genkey | tee server_private.key | wg pubkey > server_public.key

You can view your keys using cat server_private.key and cat server_public.key. Never share the private key.

Step 3: Configure the Server Interface

Create a configuration file for the WireGuard interface (typically named wg0.conf).

sudo nano /etc/wireguard/wg0.conf

Paste the following configuration, replacing <SERVER_PRIVATE_KEY> with the contents of your server_private.key file.

[Interface]
PrivateKey = <SERVER_PRIVATE_KEY>
Address = 10.8.0.1/24
ListenPort = 51820
SaveConfig = true

# The following rules allow the VPN clients to reach the internet through the server.
# Ensure your main network interface is 'eth0'. Change it if yours is different (e.g., 'ens3').
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Save and exit the file (Ctrl+O, Enter, Ctrl+X).

Step 4: Enable IP Forwarding

By default, Ubuntu will not act as a router; it drops packets that aren’t meant for itself. You must enable IP forwarding so the server can route your VPN traffic to the internet.

1. Open the sysctl configuration file:
   sudo nano /etc/sysctl.conf
2. Find the line #net.ipv4.ip_forward=1 and uncomment it by removing the #.
3. Apply the changes immediately:
   sudo sysctl -p

Step 5: Start the WireGuard Service

You can now bring the WireGuard interface up using the wg-quick command, and set it to start automatically on boot using systemd.

sudo systemctl enable [email protected]
sudo systemctl start [email protected]

To verify it is running, type sudo wg. You should see the interface details and the listening port.

Note: If you have a firewall enabled (like UFW), you must allow UDP port 51820 (sudo ufw allow 51820/udp).

Step 6: Adding Clients (Peers)

To connect a phone or laptop, you must generate a key pair on that device. Then, on the Ubuntu server, use the wg command to add the client’s public key as an authorized peer, assigning it a specific IP address within the VPN subnet (e.g., 10.8.0.2).

sudo wg set wg0 peer <CLIENT_PUBLIC_KEY> allowed-ips 10.8.0.2/32

Because you included SaveConfig = true in your server configuration, WireGuard will automatically save this new peer to wg0.conf when the service is restarted or shut down.