To set up WireGuard on Ubuntu Server 24.04, install the package, create a key pair for each peer, assign a private VPN subnet, configure matching peer entries, and start the wg-quick interface. First choose whether clients should reach only selected home or office networks, connect two sites, or send all internet traffic through the VPN host: each topology needs different routes, forwarding, firewall rules, and sometimes DNS settings.
Choose the right WireGuard topology
Decide which traffic should cross the tunnel before writing configuration. Ubuntu’s WireGuard VPN overview distinguishes common deployment patterns; the key practical difference is what each peer is allowed to reach and how return traffic gets back.
As an Amazon Associate I earn from qualifying purchases.
| Topology | What it does | What to plan |
|---|---|---|
| Peer-to-site | A roaming laptop or phone reaches selected devices or subnets behind a home or office gateway. | Route only the VPN subnet and intended private prefixes. The fixed-side peer commonly has no Endpoint when the roaming client’s address changes. See Ubuntu’s peer-to-site guide. |
| Site-to-site | Two networks route traffic to each other through WireGuard gateways. | Plan routes and return paths at both sites. Routed inter-site traffic should generally remain routed rather than be hidden by masquerading/NAT. See Ubuntu’s site-to-site guide. |
| Full tunnel/default gateway | A client sends internet traffic through the VPN gateway as well as any private-network traffic. | The gateway must be reachable and configured to forward and provide internet egress, typically with masquerading. The client needs appropriate DNS handling. See Ubuntu’s default-gateway guide. |
A home router, an always-on host inside the network, or a reachable public VM can serve as an endpoint, depending on the deployment. The endpoint’s owner controls its firewall and routing. A tunnel alone does not decide which LAN hosts or peers may communicate; use firewall policy to define that access.
Plan addresses, peers, and access scope
Before installing, write down the existing LAN subnet, the subnet you will use inside WireGuard, each peer’s VPN address, the UDP listen port, and the destination prefixes each peer should reach. Choose a VPN subnet that does not overlap the LAN or networks clients commonly use elsewhere, such as a hotel or another office. Use the actual interface names, public endpoint address, firewall owner, and LAN routes for your system; examples must be adapted rather than copied unchanged.
- Give every peer its own private/public key pair and VPN address.
- Decide explicitly whether a peer can reach only the VPN host, selected LAN prefixes, other VPN peers, or all internet destinations.
- Allow the chosen UDP listen port through the network firewall to the endpoint. Restrict it to known remote addresses where that is practical.
- Identify whether the host’s firewall is managed with nftables, UFW, another tool, or router rules before adding anything.
Ubuntu explains that AllowedIPs is both a routing key for outgoing traffic and an access-control list for received traffic. It is not merely a convenience field: overly broad prefixes can route more traffic to a peer and permit more source addresses than intended. The 0.0.0.0/0 prefix means all IPv4 destinations, so reserve it for an intentional IPv4 full tunnel. See Ubuntu’s WireGuard introduction.
Install WireGuard and create peer keys
-
Install the Ubuntu package:
sudo apt update sudo apt install wireguard -
Create a private key for the server-side interface and derive its public key. Keep the private key secret:
umask 077 wg genkey | tee server_private.key | wg pubkey > server_public.key -
Repeat key generation separately for each client or remote site. Exchange public keys with the other peer; never reuse a private key as another peer’s identity.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Store the production configuration under
/etc/wireguard/, the conventional location used bywg-quick. Ensure private key files and configuration files containing private keys are readable only by the account or service that needs them.
Ubuntu documents key creation and configuration in its common WireGuard tasks. A private key, full configuration file, and enrollment QR code are credentials: anyone who obtains them may be able to authenticate as that peer.
Configure the gateway and one peer
The following is a schematic peer-to-site example. Replace every example address, key, port, endpoint, interface, and network prefix with values for your environment. The gateway is assumed to have a route to 192.168.50.0/24; whether it needs IP forwarding or additional LAN routes depends on how the rest of the network returns traffic.
Gateway: /etc/wireguard/wg0.conf
[Interface]
Address = 10.44.0.1/24
ListenPort = 51820
PrivateKey = <gateway-private-key>
[Peer]
# Roaming laptop
PublicKey = <laptop-public-key>
AllowedIPs = 10.44.0.2/32Roaming laptop
[Interface]
Address = 10.44.0.2/24
PrivateKey = <laptop-private-key>
[Peer]
# Gateway's public key and reachable address
PublicKey = <gateway-public-key>
Endpoint = <gateway-public-address>:51820
AllowedIPs = 10.44.0.0/24, 192.168.50.0/24
PersistentKeepalive = 25In this example, the laptop sends traffic for the VPN subnet and the selected LAN prefix through the tunnel. Its peer entry on the gateway names only the laptop’s VPN address, limiting the source prefix accepted from that peer. Add other LAN prefixes only if they should be reachable. PersistentKeepalive can help a roaming peer behind a NAT maintain a usable mapping; it is not a substitute for a reachable endpoint or an allowed UDP port.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThe gateway’s [Interface] section defines its tunnel address, UDP port, and private key. Each [Peer] section identifies the other side by public key and assigns that peer’s allowed IP prefixes. An Endpoint is the address and port to contact when initiating communication. Ubuntu notes that at least one peer needs an endpoint configured to initiate the VPN; for a roaming client, the client usually initiates toward the stable gateway address. Do not publish or reuse the example key placeholders as real credentials.
Start the tunnel and enable it at boot
-
Bring up the interface manually to test the configuration:
sudo wg-quick up wg0 -
Check WireGuard’s peer state and counters:
sudo wg show wg0Look for the expected public key, a recent handshake after the remote peer connects, and transfer counters that change when you send traffic.
-
Check the host’s addresses and routes:
ip address show dev wg0 ip routeConfirm that the intended VPN and private-network prefixes use the expected path.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Test a specific host that should be reachable, not just the tunnel interface. Then test from the remote side whether any unintended destinations are reachable.
Rank #3
-
After the manual test succeeds, enable the interface at boot and verify its unit:
sudo systemctl enable wg-quick@wg0 sudo systemctl status wg-quick@wg0
Use the matching unit name for the interface if it is not wg0. Ubuntu’s common tasks documentation covers systemd operation and troubleshooting. If a configuration change affects PostUp actions, a full interface restart may be needed to rerun setup actions; a reload does not necessarily repeat them.
Limit access with firewall and routing policy
WireGuard encryption and peer authentication do not automatically create a safe network boundary. A connected peer can have a path toward its own network, and traffic can flow in either direction wherever routing and firewall rules permit. Apply policy at the gateway and, where necessary, on destination hosts to allow only the required sources, destinations, protocols, and ports.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Allow inbound WireGuard UDP on the selected port at the perimeter and host firewall.
- Permit forwarded traffic only between the VPN subnet and the LAN prefixes and services that remote users need.
- Restrict access between VPN peers if they do not need to communicate with each other.
- For site-to-site links, confirm both sites have routes back to the other site’s prefixes. Avoid NAT on traffic that should preserve the original routed addresses.
Do not paste firewall commands from a different management stack without checking what currently owns the rules. Ubuntu warns that VPN utilities may alter firewall rules, and combining firewall management methods can produce unexpected interactions. Review the Ubuntu nftables guidance and the active host or router firewall configuration before changing policy. Ubuntu’s WireGuard security tips also discuss restricting peer and network access.
Optional: enroll a phone with a QR code
Ubuntu documents using qrencode to display a phone peer’s configuration as a QR code. This is convenient for enrollment, but the code embeds the peer’s private key and should be handled like a secret.
-
Create a separate key pair and configuration for the phone, with its own VPN address and narrowly scoped
AllowedIPs. -
Install the QR encoding utility if needed and render the configuration in the terminal:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.sudo apt install qrencode qrencode -t ansiutf8 < phone.conf -
Scan it only on the intended phone, in a private setting, and avoid screenshots, shared terminals, or logs that could expose it.
Ubuntu’s common-tasks documentation explicitly warns that a QR code contains private key material. If a code or configuration is disclosed, remove that peer’s authorization and issue a replacement key/configuration rather than continuing to trust the exposed credential. See Ubuntu’s QR enrollment instructions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Optional: route all IPv4 internet traffic through WireGuard
A full tunnel is a different design from remote access to selected private subnets. Ubuntu’s default-gateway example uses a reachable gateway and a client route for all IPv4 destinations. The gateway must forward client packets and provide egress to the internet, commonly through masquerading on its outbound interface.
Change the client route deliberately
In the client’s gateway peer section, use:
AllowedIPs = 0.0.0.0/0This routes all IPv4 destinations through that peer. It does not by itself configure gateway forwarding, NAT, DNS, or an IPv6 full tunnel. Choose an IPv6 policy separately; leaving IPv6 outside the tunnel can mean that IPv6 traffic does not follow the IPv4 route.
Free tools Windows power users keep installed
One-click scans. No signup required.
Prepare gateway egress and DNS
Enable forwarding on the gateway and configure firewall/NAT rules so traffic arriving from the WireGuard subnet can leave through the real internet-facing interface. The correct interface name, firewall syntax, provider networking rules, and persistence method depend on the machine. Do not assume a sample interface name or copy a rule without confirming the system’s active firewall owner.
Best Value
Choose a resolver that clients can reach through the tunnel and configure the client accordingly. On Ubuntu systems using systemd-resolved, resolvectl can help inspect resolver state. Test both IP connectivity and name resolution: a successful tunnel handshake does not establish that DNS requests use the intended resolver. Check for policy-routing behavior and unintended DNS or IPv6 paths if the goal is to keep all traffic on the VPN.
Troubleshoot by symptom
No handshake appears
- Confirm the remote endpoint address and UDP port are correct and reachable.
- Check perimeter and host firewall rules for the WireGuard UDP port.
- Verify that each peer has the other peer’s correct public key and that the private key belongs to the expected interface.
- Ensure at least one side has an endpoint configured so it can initiate.
Handshake succeeds, but the target host is unreachable
- Check that
AllowedIPsincludes the intended destination prefixes on the sending peer and the correct source prefixes on the receiving peer. - Inspect routes on both sides and ensure forwarding is enabled wherever traffic must pass through a gateway.
- Check firewall rules on the gateway and target host for the actual source, destination, protocol, and port.
- Test the gateway’s tunnel address and a host behind it separately; success to the gateway alone does not prove LAN routing works.
Site-to-site traffic works only one way
Inspect routes and return paths at both networks. Confirm that each site knows how to reach the other site’s prefixes and avoid applying NAT to traffic intended to remain routed between the private networks.
Full tunnel connects, but internet or DNS fails
Check gateway forwarding, outbound masquerading, policy routes, and the selected client resolver. On Ubuntu’s systemd-resolved setup, inspect resolver state with resolvectl; test an IP destination separately from a hostname to distinguish routing from name-resolution problems.
Recommended Free Tools
Configuration changes do not take effect
Inspect the interface and systemd unit state. Changes to PostUp setup actions may require taking the interface down and starting it again so wg-quick reruns those actions.
A configuration or QR code was exposed
Treat the affected peer credential as compromised: revoke that peer’s authorization, create a new key pair, and distribute a replacement configuration through a protected channel.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
