> ## Documentation Index
> Fetch the complete documentation index at: https://flashrdp.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Set Up a Private WireGuard VPN Server on a Linux VPS

> Turn a Debian or Ubuntu Linux VPS into a private WireGuard VPN for your own devices: install, generate keys, configure wg0, forward traffic and add clients.

**To run a private WireGuard VPN, install `wireguard` on a Debian or Ubuntu Linux VPS, generate a key pair for the server and each device, describe them in `/etc/wireguard/wg0.conf`, enable IP forwarding and start `wg-quick@wg0`.** Your laptop and phone then reach the internet, or your private services, through the server's IP address.

<Tip>Need a server for it? A [FlashRDP WireGuard VPS](https://flashrdp.com/ubuntu-vps-for-wireguard?utm_source=docs\&utm_medium=guide\&utm_campaign=wireguard) comes with a dedicated IPv4 and full root, in Phoenix, AZ or Paris, France, from \$11.99/mo.</Tip>

<Warning>
  This guide is for a **private** VPN for your own devices and team. FlashRDP's [Acceptable Use Policy](/docs/terms/use-of-service) prohibits open or public proxies and public VPN services, so don't share access with the public or sell VPN accounts.
</Warning>

## What you need

* A FlashRDP [Linux VPS](/docs/linux-vps/overview) running **Debian 12/13** or **Ubuntu 22.04/24.04 LTS**, with [SSH access as root](/docs/linux-vps/ssh-access).
* The WireGuard app on each device: Windows, macOS, iOS, Android or Linux.

WireGuard is light: any plan, including **BRONZE**, has plenty of CPU and RAM for a handful of devices.

## Install WireGuard

```bash theme={null}
apt update && apt install -y wireguard iptables
```

## Generate the server keys

Restrict file permissions first, then create the server's private and public key:

```bash theme={null}
cd /etc/wireguard
umask 077
wg genkey | tee server.key | wg pubkey > server.pub
```

Repeat for each device you'll connect, for example a laptop:

```bash theme={null}
wg genkey | tee laptop.key | wg pubkey > laptop.pub
```

<Note>
  You can also generate a device's keys in its WireGuard app and copy only its public key to the server. A private key should never leave the device that uses it.
</Note>

## Find your network interface

The forwarding rules below need the name of the server's public network interface:

```bash theme={null}
ip route show default
```

The name follows `dev`, for example `eth0` or `ens3`. Replace `eth0` below with yours.

## Configure wg0

Create `/etc/wireguard/wg0.conf`, pasting the contents of `server.key` and `laptop.pub`:

```ini theme={null}
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <contents of server.key>
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# laptop
PublicKey = <contents of laptop.pub>
AllowedIPs = 10.8.0.2/32
```

`wg-quick` runs `PostUp` and `PostDown` with bash, and `%i` becomes the interface name (`wg0`). Add one `[Peer]` block per device, each with its own `/32` address.

## Enable IP forwarding

Let the server route traffic for your devices:

```bash theme={null}
echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-wireguard.conf
sysctl --system
```

## Start WireGuard

```bash theme={null}
systemctl enable --now wg-quick@wg0
wg show
```

If you use a firewall such as UFW, allow the WireGuard port: `ufw allow 51820/udp`.

## Configure a device

Create a tunnel in the device's WireGuard app with this configuration:

```ini theme={null}
[Interface]
Address = 10.8.0.2/24
PrivateKey = <contents of laptop.key>
DNS = 1.1.1.1

[Peer]
PublicKey = <contents of server.pub>
Endpoint = YOUR_SERVER_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
```

`AllowedIPs = 0.0.0.0/0` sends all of the device's traffic through the VPN. To reach only services on the server, use `AllowedIPs = 10.8.0.0/24` instead. `PersistentKeepalive = 25` keeps the tunnel open through home and mobile NAT; WireGuard's docs call 25 seconds a sensible interval for most firewalls.

Activate the tunnel, then run `wg show` on the server: a recent **latest handshake** means the device is connected.

## Add more devices

Generate a key pair for the device, add a `[Peer]` block with the next free address (`10.8.0.3/32`, and so on), then reload without dropping existing connections:

```bash theme={null}
wg syncconf wg0 <(wg-quick strip wg0)
```

## Related Articles

<CardGroup cols={2}>
  <Card horizontal title="Connect via SSH" icon="plug" href="/docs/linux-vps/ssh-access" />

  <Card horizontal title="Debian VPS" icon="server" href="/docs/guides/debian-vps" />

  <Card horizontal title="Ubuntu VPS" icon="server" href="/docs/guides/ubuntu-vps" />

  <Card horizontal title="Acceptable Use Policy" icon="scale" href="/docs/terms/use-of-service" />
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.