← Blog

How to Set Up Your Own WireGuard VPN Server

You can run your own VPN with WireGuard using a small VPS with a public IPv4 address. The setup involves installing WireGuard, generating keys, enabling IP forwarding, configuring NAT and firewall rules, and importing a client profile. This guide walks through the complete setup and explains when self-hosting makes sense compared with a managed VPN service.

What you need

Prepare an Ubuntu 24.04 LTS VPS with 1 vCPU, 512 MB–1 GB RAM, a public IPv4 address, and enough bandwidth. You also need root or sudo access, permission to receive UDP traffic, a WireGuard client on your phone or computer, and basic Linux terminal knowledge. The network will look like this:

Phone / Laptop
      │
      │ WireGuard
      ▼
Ubuntu VPS
      │
      ▼
   Internet

1. Rent a VPS

Choose any provider that offers a Linux VPS, public IPv4, UDP traffic, and a region close to the devices that will connect. Do not pick a provider only because it is cheap: check bandwidth limits, backup options, abuse policies, and whether you can open the WireGuard port. A small server is enough for one or a few personal devices.

2. Install WireGuard

Connect to the VPS over SSH, update the package index, and install the distribution package:

sudo apt update
sudo apt install wireguard
wg --version
Use the version output to confirm that the command-line tools are installed. Keep SSH open in a second terminal while changing firewall rules so a mistake does not lock you out.

3. Generate server and client keys

WireGuard authenticates peers with public-key cryptography. Keep every private key secret and share only the matching public key. Generate one server key pair and one client key pair with restrictive permissions:

sudo install -m 700 -d /etc/wireguard
sudo sh -c "umask 077; wg genkey > /etc/wireguard/server.key; wg pubkey < /etc/wireguard/server.key > /etc/wireguard/server.pub"
umask 077
wg genkey > client.key
wg pubkey < client.key > client.pub
Read the values only when you need to place them in configuration. Never paste a private key into a ticket, chat, screenshot, or public repository.

4. Create the WireGuard network

Use a private subnet that does not overlap with networks you regularly use. This example uses 10.8.0.0/24: the server is 10.8.0.1 and the first client is 10.8.0.2. The /24 suffix leaves room for additional peers while keeping the configuration easy to understand.

5. Configure wg0.conf

Create the server configuration at /etc/wireguard/wg0.conf. Replace the placeholders with the actual server private key and client public key. The UDP port can be changed, but every client and firewall rule must use the same port:

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.8.0.2/32
Address is the server tunnel IP. AllowedIPs assigns the client address and prevents two peers from claiming the same tunnel IP. If your VPS uses an interface name other than eth0, find it with ip route get 1.1.1.1 and use that interface in the NAT rule.

6. Enable IP forwarding

Forwarding allows the VPS to route packets from the WireGuard tunnel to the public internet. Add these settings, then load them:

sudo tee /etc/sysctl.d/99-wireguard-forwarding.conf > /dev/null <<EOF
net.ipv4.ip_forward = 1
EOF
sudo sysctl --system
Without forwarding, the client may connect successfully but internet traffic will not pass through the server.

7. Configure NAT and firewall access

Allow the WireGuard UDP port in the VPS firewall and keep SSH open. With UFW, use:

sudo ufw allow OpenSSH
sudo ufw allow 51820/udp
sudo ufw enable
sudo ufw status verbose
The NAT rule in wg0.conf translates the private tunnel address to the VPS public address. Provider firewalls may be separate from UFW, so check the provider dashboard too. Do not expose administrative ports you do not need.

8. Start WireGuard automatically

Bring the interface up and enable it at boot:

sudo systemctl enable --now wg-quick@wg0
sudo wg show
ip address show wg0
Use sudo systemctl status wg-quick@wg0 and sudo journalctl -u wg-quick@wg0 when the interface fails to start.

9. Add your phone or laptop

Create a client profile using the client private key, the server public key, the tunnel addresses, and the VPS public IP. For a full-tunnel profile, send all traffic through the VPN:

[Interface]
PrivateKey = CLIENT_PRIVATE_KEY
Address = 10.8.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = VPS_PUBLIC_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
Import the profile into the official WireGuard app on Android, iPhone, Windows, macOS, or Linux. The keepalive value helps clients behind NAT stay reachable; it is especially useful on mobile networks.

How much does a self-hosted WireGuard VPN cost?

The software is free, but the server is not. A realistic personal setup usually includes the VPS subscription, the public IPv4 address if billed separately, bandwidth overage, backups if you choose them, and your own time for maintenance. The cheapest plan is not automatically the lowest total cost: a small outage, lost SSH access, or a compromised server can cost more than a few dollars saved. One VPS also usually means one exit location. To add another country, you generally need another server, another key set, and another configuration.

Should you actually host your own VPN?

Choose self-hosted WireGuard when you need a dedicated IP, homelab or internal infrastructure access, site-to-site networking, custom routing, full server control, or you want to learn Linux and networking. Choose a managed VPN when you simply want private internet access, multiple countries, mobile and desktop connectivity, quick setup, and no firewall, key, server, or patch maintenance. Self-hosting is not bad or insecure by definition; it just transfers responsibility to you.

Self-hosted WireGuard or ZeroBlock?

You can absolutely build this yourself. Self-host WireGuard when you need control. Use ZeroBlock when you just need a VPN. Running WireGuard is straightforward; running VPN infrastructure is the part that grows complicated. If your goal is to browse privately from multiple locations without becoming a VPN administrator, ZeroBlock handles the server and connection details so you can connect from the app instead of maintaining a VPS.

Troubleshooting common problems

Handshake never appears: verify the VPS public IP, UDP port, provider firewall, and client clock. Handshake works but there is no internet: check IP forwarding, the NAT interface name, and AllowedIPs. DNS fails: test with a known resolver or temporarily use the VPS resolver. Only some sites work: check MTU and path-specific filtering before changing keys. SSH stopped working: use the provider console and restore the SSH firewall rule. Read the official WireGuard quickstart before making advanced changes.

Deployment checklist

  • VPS has a public IPv4 address and UDP 51820 is allowed.
  • Server and client private keys are stored securely.
  • The server uses a unique tunnel subnet and client IP.
  • IP forwarding and NAT are enabled.
  • SSH remains allowed before enabling the firewall.
  • The client profile uses the correct endpoint and server public key.
  • The tunnel is tested with wg show, an IP check, and a DNS leak test.

Written by the ZeroBlock Engineering Team. We operate VPN infrastructure across multiple regions and build privacy networking software. This guide was reviewed on September 3, 2026 for Ubuntu 24.04 LTS. Provider firewall names, interface names, pricing, and policies vary; verify those details in your VPS dashboard. Do not become a VPN administrator just because you need a VPN — but if control is the goal, WireGuard is an excellent tool.

Download APK See pricing