Add peers & ports — generate a ready-to-paste wg0.conf and client configs
/etc/wireguard/wg0.conf on the VPS.# Fill in the fields above to generate your config
SSH into your VPS and update all packages before doing anything else.
ssh root@YOUR_VPS_IP
apt update && apt upgrade -yAllows the VPS to pass traffic through rather than just receiving it. Required for port forwarding to work.
nano /etc/sysctl.conf
#net.ipv4.ip_forward=1 — remove the #. Save with Ctrl+X, Y, Enter.sysctl -p
net.ipv4.ip_forward = 1 printed back.UFW has a separate file that blocks all forwarding by default. Normal UFW commands cannot change it — you must edit the file directly.
nano /etc/default/ufw
DEFAULT_FORWARD_POLICY="DROP" → change to DEFAULT_FORWARD_POLICY="ACCEPT". Save and close.apt install wireguard -y
Generates the server private and public key pair. Paste both into the configuration panel at the top.
cd /etc/wireguard wg genkey | tee server_private.key | wg pubkey > server_public.key chmod 600 server_private.key echo "=== PRIVATE KEY (keep secret) ===" && cat server_private.key echo "=== PUBLIC KEY (share with peers) ===" && cat server_public.key
Look for the word immediately after dev — it will be something like eth0, ens3, or enp1s0. Enter it in the Network Interface field above.
ip route | grep default
Open the config file then paste the entire block from the generated panel above. Make sure all your keys, peers, and ports are filled in first.
nano /etc/wireguard/wg0.conf
[Peer] block by adding # at the start of each line. Add it later with wg syncconf without restarting.Generated from your port configuration above.
# Add ports above to generate
Allow forwarded traffic to pass through UFW to each peer. Without these, UFW drops packets before they reach the tunnel.
# Add ports above to generate
Enable WireGuard to start at boot and start it now.
systemctl enable wg-quick@wg0 systemctl start wg-quick@wg0 wg show
wg0 interface. No peer handshakes yet is expected — they connect when a client comes online.wg0.conf then run wg syncconf wg0 <(wg-quick strip wg0)Run on the VPS after a peer connects. Look for a recent handshake timestamp.
wg show # latest handshake should be seconds or minutes ago
Run on the peer client. Must return the VPS IP, not your home IP.
curl ifconfig.me
# Expected: YOUR_VPS_IPiptables -t nat -L PREROUTING -n -v # Each port should appear exactly once # Duplicates? Fix: iptables -t nat -F && systemctl restart wg-quick@wg0
With peer connected and a service listening on the port, test reachability. Replace PORT with your forwarded port number.
curl -v --max-time 10 http://YOUR_VPS_IP:PORTsystemctl status wg-quick@wg0.service journalctl -xeu wg-quick@wg0.service
sudo wg show # No handshake: VPS missing peer public key, or wrong endpoint/port # Handshake exists but leaking: AllowedIPs must be 0.0.0.0/0 on peer
# 1. UFW allowing the port?
ufw status verbose
# 2. iptables DNAT rules loaded?
iptables -t nat -L PREROUTING -n -v
# 3. Packets arriving on VPS? (trigger from outside while running)
tcpdump -i eth0 tcp port PORT -n
# 4. Packets crossing the tunnel?
tcpdump -i wg0 tcp port PORT -n
# 5. Is peer connected?
wg showiptables -t nat -F && systemctl restart wg-quick@wg0nano /etc/wireguard/wg0.conf # Add new [Peer] block at bottom, then reload without dropping connections: wg syncconf wg0 <(wg-quick strip wg0)
Every peer client needs a wg0.conf with this structure. See the generated client configs above for your specific values pre-filled.
[Interface] Address = PEER_TUNNEL_IP/24 # e.g. 10.0.0.2/24 PrivateKey = PEER_PRIVATE_KEY # generated on the peer machine DNS = 1.1.1.1 [Peer] PublicKey = VPS_PUBLIC_KEY # from your VPS setup above Endpoint = VPS_IP:WG_PORT # e.g. 172.245.213.155:51820 AllowedIPs = 0.0.0.0/0 # route all traffic through VPS PersistentKeepalive = 25 # keeps tunnel alive through NAT
wg genkey | tee private.key | wg pubkey > public.key. The peer's public key goes into the VPS wg0.conf [Peer] block. The private key stays on the peer only.