Skip to main content
To run a private WireGuard VPN, install wireguard on a Debian or Ubuntu Linux VPS, generate a key pair for the server and each device, describe them in /etc/wireguard/wg0.conf, enable IP forwarding and start wg-quick@wg0. Your laptop and phone then reach the internet, or your private services, through the server’s IP address.
Need a server for it? A FlashRDP WireGuard VPS comes with a dedicated IPv4 and full root, in Phoenix, AZ or Paris, France, from $11.99/mo.
This guide is for a private VPN for your own devices and team. FlashRDP’s Acceptable Use Policy prohibits open or public proxies and public VPN services, so don’t share access with the public or sell VPN accounts.

​
What you need

  • A FlashRDP Linux VPS running Debian 12/13 or Ubuntu 22.04/24.04 LTS, with SSH access as root.
  • The WireGuard app on each device: Windows, macOS, iOS, Android or Linux.
WireGuard is light: any plan, including BRONZE, has plenty of CPU and RAM for a handful of devices.

​
Install WireGuard

​
Generate the server keys

Restrict file permissions first, then create the server’s private and public key:
Repeat for each device you’ll connect, for example a laptop:
You can also generate a device’s keys in its WireGuard app and copy only its public key to the server. A private key should never leave the device that uses it.

​
Find your network interface

The forwarding rules below need the name of the server’s public network interface:
The name follows dev, for example eth0 or ens3. Replace eth0 below with yours.

​
Configure wg0

Create /etc/wireguard/wg0.conf, pasting the contents of server.key and laptop.pub:
wg-quick runs PostUp and PostDown with bash, and %i becomes the interface name (wg0). Add one [Peer] block per device, each with its own /32 address.

​
Enable IP forwarding

Let the server route traffic for your devices:

​
Start WireGuard

If you use a firewall such as UFW, allow the WireGuard port: ufw allow 51820/udp.

​
Configure a device

Create a tunnel in the device’s WireGuard app with this configuration:
AllowedIPs = 0.0.0.0/0 sends all of the device’s traffic through the VPN. To reach only services on the server, use AllowedIPs = 10.8.0.0/24 instead. PersistentKeepalive = 25 keeps the tunnel open through home and mobile NAT; WireGuard’s docs call 25 seconds a sensible interval for most firewalls. Activate the tunnel, then run wg show on the server: a recent latest handshake means the device is connected.

​
Add more devices

Generate a key pair for the device, add a [Peer] block with the next free address (10.8.0.3/32, and so on), then reload without dropping existing connections:

Connect via SSH

Debian VPS

Ubuntu VPS

Acceptable Use Policy

Last modified on October 12, 2026