Skip to content
GhostRDP
  • Networking and privacy
  • Linux VPS
  • Ubuntu 24.04

Set up your own WireGuard VPN server

Your own WireGuard VPN runs well on a GhostRDP Linux VPS Basic plan with 2 vCPU and 6 GB RAM in Germany or the Netherlands, from €5.99/mo.

WireGuard is a fast, modern VPN built into the Linux kernel. With your own server you get a dedicated IP address that only you use. This guide sets up the server, one client and a QR code for the phone app.

Order Basic · €5.99/moInstall steps

  • Modern encryption

    WireGuard is fast, small and built into Linux.

  • Your own exit IP

    A dedicated IPv4 in Germany or the Netherlands.

  • Light and quick

    Barely uses the server, even with several devices.

Plans for WireGuard VPN

WireGuard needs very little CPU or memory. Basic handles a household of devices easily.

  • Linux VPS Basic

    Recommended

    €5.99/mo

    €5.09/mo billed yearly, save €10/year

    • 2 vCPU
    • 6 GB ECC RAM
    • 40 GB NVMe
    • 1 Gbps port
    Order Basic

  • Linux VPS Standard

    €12.99/mo

    €11.04/mo billed yearly, save €23/year

    • 4 vCPU
    • 8 GB ECC RAM
    • 70 GB NVMe
    • 1 Gbps port
    Order Standard

  • Linux VPS Pro

    €25.99/mo

    €22.09/mo billed yearly, save €46/year

    • 6 vCPU
    • 12 GB ECC RAM
    • 90 GB NVMe
    • 1 Gbps port
    Order Pro

What you need

  • Operating system
    Linux VPS with Ubuntu 24.04
  • Minimum resources
    1 vCPU and 512 MB RAM
  • Client app
    WireGuard for Windows, macOS, Linux, Android or iOS (wireguard.com/install)

Official site: wireguard.com

How to install WireGuard VPN

Written for Ubuntu 24.04 from the official instructions. Run the commands as root and replace YOUR_SERVER_IP with your server's address.

  1. 1

    Connect to your server over SSH

    Use the IP address and root password from your welcome email (the server page has a Copy SSH command button). Windows 10 and 11, macOS and Linux all include an SSH client in the terminal.

    Shell
    ssh root@YOUR_SERVER_IP
  2. 2

    Update the system

    Install the latest security updates before you add anything else.

    Shell
    apt update && apt -y upgrade
  3. 3

    Install WireGuard and create keys

    Creates a key pair for the server and one for your first device.

    Shell
    apt install -y wireguard qrencode
cd /etc/wireguard
umask 077
wg genkey | tee server.key | wg pubkey > server.pub
wg genkey | tee client.key | wg pubkey > client.pub
  4. 4

    Write the server config

    Finds your network interface, then writes wg0.conf with NAT so your device's traffic leaves through the server.

    Shell
    IFACE=$(ip route show default | awk '{print $5; exit}')
cat > /etc/wireguard/wg0.conf <<EOF
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = $(cat /etc/wireguard/server.key)
PostUp = iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o $IFACE -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o $IFACE -j MASQUERADE

[Peer]
PublicKey = $(cat /etc/wireguard/client.pub)
AllowedIPs = 10.8.0.2/32
EOF
  5. 5

    Turn on forwarding and start WireGuard

    Lets the server pass traffic on, and starts the tunnel now and on every boot.

    Shell
    echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-wireguard.conf
sysctl --system
systemctl enable --now wg-quick@wg0
wg show
  6. 6

    Create the client config

    Your server has one IPv4 address and no IPv6, so the config also routes IPv6 (::/0) into the tunnel. That stops IPv6 traffic from leaving outside the VPN.

    Shell
    SERVER_IP=$(hostname -I | awk '{print $1}')
cat > /etc/wireguard/client.conf <<EOF
[Interface]
PrivateKey = $(cat /etc/wireguard/client.key)
Address = 10.8.0.2/32
DNS = 9.9.9.9

[Peer]
PublicKey = $(cat /etc/wireguard/server.pub)
Endpoint = $SERVER_IP:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25
EOF
qrencode -t ansiutf8 < /etc/wireguard/client.conf
  7. 7

    Connect your device

    On a phone, open the WireGuard app, tap + and scan the QR code. On a computer, copy the text of client.conf (cat /etc/wireguard/client.conf) into a new tunnel in the WireGuard app. Then switch the tunnel on.

After installing

  • Check it works
    With the tunnel on, an IP check website should show your server's IP address. On the server, wg show lists your device with a recent handshake.
  • Port
    WireGuard listens on UDP 51820. If you turn on a firewall such as ufw, allow 51820/udp and SSH (22/tcp) first.
  • More devices
    Create a new key pair per device, add a [Peer] block with the next address (10.8.0.3/32 and so on) and run systemctl restart wg-quick@wg0.

WireGuard VPN questions

Which plan do I need for a WireGuard VPN?

The Basic Linux VPS. WireGuard is very light, and a 1 Gbps port is far more than most home connections.

Which country will my VPN IP be in?

Germany or the Netherlands, the location you pick when you order. Those are our only two locations.

Do you log VPN traffic?

The VPN runs on your own server and you control its configuration. Our privacy policy describes what we keep as your host.

Does it support IPv6?

Our servers have IPv4 only. The client config on this page sends IPv6 into the tunnel, where it stops, so it can't leak around the VPN.

Can I share the VPN with family?

Yes. Add one [Peer] block and one client config per device.

Stuck on a step? Our team answers on live chat and in tickets.

Related apps

More on GhostRDP

Run WireGuard VPN on your own server.

Online in minutes. Pay with crypto, no ID needed.

Choose a plan