Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Yes—you can run a complete WireGuard VPN server on an Ubuntu host with the distribution package and a small set of configuration files. The reliable sequence is to choose a non-overlapping tunnel subnet, create a unique key pair for the server and every peer, build /etc/wireguard/wg0.conf, then enable forwarding and source NAT if clients must reach the internet through Ubuntu. Bring the interface up with wg-quick, verify a real destination beyond the VPN host, and enable wg-quick@wg0 so the tunnel returns after a reboot.
This guide covers peer-to-site access, an all-traffic default gateway, and routed LAN designs. The commands use Ubuntu’s package layout and a sample tunnel network of 10.90.90.0/24; replace every sample address, key, hostname, and interface name with values from your network.
As an Amazon Associate I earn from qualifying purchases.
What must I decide before installing WireGuard on Ubuntu?
Decide the traffic pattern and address plan first. WireGuard is a network interface rather than a separate proxy service: the interface gets an address, peers are assigned routes, and ordinary Ubuntu routing determines where packets go.
Choose the topology
| Design | What clients can reach | Ubuntu features normally required |
|---|---|---|
| Peer-to-site | The Ubuntu host and selected private networks | WireGuard interface and routes; forwarding when traffic must cross the host |
| Default gateway | All client IPv4 traffic, represented by 0.0.0.0/0 |
IPv4 forwarding, source NAT/MASQUERADE, and firewall rules that permit forwarding |
| Site-to-site or routed LAN | A remote network behind the Ubuntu gateway | Forwarding, return routes on the LAN, and sometimes proxy ARP |
Reserve a private tunnel subnet that does not overlap with any client LAN or remote site. In the examples below, the server is 10.90.90.1/24 and the first peer is 10.90.90.2/32. Give every additional peer a different address in the same tunnel range. An overlap can make the operating system send traffic to the wrong interface, producing failures that look like a key or firewall problem.
#1 Best Overall
Record the values you will need
- The Ubuntu server’s public address or DNS name.
- The UDP listen port you intend to expose;
51820is used in the examples, but it is a choice, not a requirement. - The real outbound interface name used to reach the internet. The sample
eth0must be replaced with the interface shown byip routeon your host. - One tunnel address for the server and one unique tunnel address for each peer.
- Whether each peer has a fixed reachable endpoint or will initiate from behind changing NAT.
Canonical Ubuntu describes WireGuard as something to “think of … primarily as a network interface, like any other.” That model explains why a working handshake alone does not automatically provide internet access: routing and, where needed, NAT are separate jobs.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11How do I install WireGuard and create the server keys?
Install the Ubuntu package, create a directory readable only by root, and generate a different key pair for the server and every peer. Keep private keys on the device that owns them; distribute only public keys.
- Refresh package metadata and install WireGuard.
sudo apt update sudo apt install wireguardThe exact WireGuard package and tool versions depend on the Ubuntu release installed on the target machine. Confirm the package is available from that release before proceeding.
- Create the configuration directory with restrictive permissions.
sudo install -d -m 700 /etc/wireguard - Generate the server key pair.
cd /etc/wireguard sudo sh -c 'umask 077; wg genkey > server.key; wg pubkey < server.key > server.pub'umask 077makes newly created key files accessible only to their owner. The private key remains inserver.key;server.pubis safe to copy into peer configurations. - Generate a separate pair for each client.
sudo sh -c 'umask 077; wg genkey > client1.key; wg pubkey < client1.key > client1.pub'Repeat with a distinct filename for every peer. Never reuse one private key across several clients: a lost device would then require replacing the shared identity everywhere.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. - Lock down the files.
sudo chmod 600 /etc/wireguard/wg0.conf /etc/wireguard/*.keyRun the command after creating
wg0.conf; if the file does not exist yet, apply the same mode as soon as you save it.
Use the contents of a private-key file exactly as generated, without adding quotation marks. Do not paste a private key into a ticket, chat, screenshot, or peer configuration intended for another device.
How do I configure wg0.conf on the Ubuntu server?
Create /etc/wireguard/wg0.conf with one [Interface] section and one [Peer] section per client. The interface section defines Ubuntu’s tunnel identity; each peer section maps a public key to the tunnel addresses that belong behind that peer.
Rank #2
Minimal server configuration
[Interface]
Address = 10.90.90.1/24
ListenPort = 51820
PrivateKey = <contents of /etc/wireguard/server.key>
[Peer]
PublicKey = <client-public-key>
AllowedIPs = 10.90.90.2/32Replace the angle-bracket values with real data. Do not leave the brackets in the file.
Free tools Windows power users keep installed
One-click scans. No signup required.
What each server setting does
| Setting | Purpose | Practical rule |
|---|---|---|
Address |
Assigns the WireGuard interface address and prefix. | Use the server address from your reserved, non-overlapping tunnel subnet. |
ListenPort |
Selects the UDP port on which this server listens. | Allow this UDP port in the Ubuntu host firewall, cloud firewall, and any upstream router or port-forward. |
PrivateKey |
Authenticates the server interface. | Read the value from the protected server key file; never publish it. |
PublicKey |
Identifies one peer. | Paste the peer’s public key, not its private key. |
AllowedIPs |
Lists addresses routed to that peer and accepted from it. | For a single client, a host route such as 10.90.90.2/32 prevents two peers from claiming the same address. |
Endpoint |
Provides a fixed destination for a peer. | Add it when the server must actively reach a peer at a known host and port. Clients behind changing NAT commonly initiate the connection instead. |
Adding more peers
Append another [Peer] block for each client. Give each peer a unique tunnel address and put only that peer’s address (or the remote network it represents) in its AllowedIPs. A second client might therefore use 10.90.90.3/32; it must not reuse 10.90.90.2/32.
What should the client configuration contain?
The client needs its own private key, its tunnel address, and a peer entry for the Ubuntu server. A typical client profile follows the same interface/peer model:
[Interface]
Address = 10.90.90.2/24
PrivateKey = <contents of client1.key>
[Peer]
PublicKey = <server-public-key>
Endpoint = <server-public-host>:51820
AllowedIPs = 10.90.90.0/24Use a narrower destination, such as a private LAN prefix, for split tunneling. Use AllowedIPs = 0.0.0.0/0 when this peer should send all IPv4 traffic through Ubuntu; that choice also makes the forwarding and MASQUERADE steps below mandatory for internet access. The server’s peer entry still lists the client’s tunnel address, while the client’s peer entry lists the server’s public key.
How do I route all client traffic through Ubuntu?
A tunnel interface by itself does not turn Ubuntu into an internet gateway. For an all-traffic design, enable IPv4 forwarding and translate the tunnel source addresses on the actual outbound interface.
1. Enable IPv4 forwarding
Create a dedicated sysctl file:
sudo sh -c 'printf "net.ipv4.ip_forward = 1n" > /etc/sysctl.d/70-wireguard-routing.conf'Apply it with:
sudo sysctl -p /etc/sysctl.d/70-wireguard-routing.conf -wThe setting allows packets arriving on wg0 to be routed onward instead of stopping at the Ubuntu host.
2. Add source NAT
Use the tunnel subnet and the real internet-facing interface in a MASQUERADE rule:
sudo iptables -t nat -A POSTROUTING -s 10.90.90.0/24 -o eth0 -j MASQUERADEReplace eth0 with the outbound interface shown by the host’s routing table. MASQUERADE changes the source of forwarded packets to the gateway’s address so internet hosts can return traffic without a route for the private tunnel subnet.
3. Permit forwarding in your firewall
Cloud security groups, host firewalls, and distribution firewall policies can block either the incoming WireGuard UDP port or forwarded traffic. Allow the selected UDP listen port to reach the server and allow forwarding between wg0 and the outbound interface according to your security policy. Persist the NAT and firewall rules using the firewall management method already used on that Ubuntu installation; do not assume that /etc/rc.local exists.
4. Match the client route scope
On a default-gateway client, use AllowedIPs = 0.0.0.0/0 in the server peer entry on that client. On a split-tunnel client, list only the tunnel subnet and the private networks that should traverse the VPN. The route scope and the server’s forwarding/NAT policy must agree; changing one without the other produces a handshake with incomplete connectivity.
How do I route a private LAN without masquerading it?
A routed internal-network deployment lets LAN systems see the peer’s tunnel address instead of hiding it behind Ubuntu. It requires a return path: LAN routers or hosts must know that the WireGuard subnet is reachable through the Ubuntu gateway.
Plan the route
Keep the tunnel subnet distinct from the LAN subnet. Add a route for 10.90.90.0/24 on the LAN router, using the Ubuntu host’s LAN address as the next hop, or add equivalent routes on the relevant internal systems. Without that return route, the peer may reach Ubuntu but replies from another LAN host will take a different gateway.
Enable forwarding and, where the design needs it, proxy ARP
Ubuntu’s internal-system pattern enables forwarding and proxy ARP:
sudo sh -c 'printf "net.ipv4.ip_forward = 1nnet.ipv4.conf.all.proxy_arp = 1n" > /etc/sysctl.d/70-wireguard-routing.conf'
sudo sysctl -p /etc/sysctl.d/70-wireguard-routing.conf -wProxy ARP can make Ubuntu answer ARP requests on behalf of a remote VPN address when the LAN’s addressing model requires that behavior. It is not a substitute for understanding the LAN’s routing; use explicit routes when they are available and appropriate.
Test beyond the VPN endpoint
First test the Ubuntu tunnel address. Then test a host on the internal LAN that is not the WireGuard server itself. Success against only 10.90.90.1 proves the interface is reachable, not that forwarding and return routing work.
How do I start, inspect, and verify the tunnel?
Bring the interface up manually before enabling boot persistence. This separates configuration errors from systemd or reboot behavior.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #4
- Start the interface.
sudo wg-quick up wg0wg-quickcreates the interface, assigns its address, installs routes, and loads the WireGuard settings. - Inspect WireGuard state.
sudo wg showCheck that the interface exists, the expected listen port is shown, and every configured peer appears with the expected public key. After a client connects, a recent handshake and transfer counters should appear.
- Inspect the address and kernel routes.
ip address show dev wg0 ip routeConfirm that
wg0has the planned address and that routes point the intended tunnel or LAN prefixes to it. Use the default route shown here to identify the real outbound interface for the MASQUERADE rule. - Test in stages.
- From the client, test the server’s tunnel address.
- For a routed LAN, test a different LAN host.
- For a default gateway, test an internet destination beyond Ubuntu.
Testing only the VPN endpoint can hide forwarding, NAT, or return-route failures.
Recommended Free Tools
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
How do I make WireGuard start automatically after reboot?
Enable the templated systemd unit after the manual test succeeds:
sudo systemctl enable --now wg-quick@wg0--now starts the interface immediately, while enable schedules it for future boots. Check the result with:
sudo systemctl status wg-quick@wg0
sudo wg showIf the unit fails, read its service output and fix the underlying configuration or permission error before rebooting. The service expects the file at /etc/wireguard/wg0.conf; a differently named file requires the matching instance name, such as wg-quick@wg1 for wg1.conf.
Which WireGuard settings control reachability?
Three decisions determine most deployments: the destinations in AllowedIPs, whether Ubuntu routes or masquerades traffic, and which side knows the peer’s endpoint.
| Decision | Private-subnet access | All-traffic gateway | Routed internal site |
|---|---|---|---|
Client AllowedIPs |
VPN and selected LAN prefixes | 0.0.0.0/0 |
Remote LAN prefixes |
| IPv4 forwarding | Needed when crossing Ubuntu to another network | Required | Required |
| MASQUERADE | Only when the destination lacks a return route | Normally required for internet egress | Usually avoid when you can install proper LAN return routes |
| Proxy ARP | Not normally needed | Not normally needed | May be required by the internal LAN addressing model |
| Peer endpoint | Depends on which side is reachable | Clients commonly point to the server’s public host and port | Use fixed endpoints for gateways that must initiate toward one another |
AllowedIPs is both a routing declaration and a peer-address policy. On the server, assigning the same address to two peers creates ambiguity; on a client, selecting 0.0.0.0/0 intentionally captures all IPv4 destinations.
What should I check when WireGuard does not work?
Work from the lowest layer upward: configuration, UDP reachability, handshake, tunnel addressing, then forwarding and return routing.
wg-quick up wg0 fails immediately
- Check spelling, section headers, and key values in
/etc/wireguard/wg0.conf. - Confirm the file and private keys are readable by the account starting the service and are protected with mode
600. - Verify that the interface name in the command matches the configuration filename.
- Check whether another process already owns the selected UDP port.
The interface is up but there is no handshake
- Confirm that each side contains the other side’s public key.
- Verify the client’s endpoint hostname or address and UDP port.
- Allow that UDP port through the Ubuntu host firewall, cloud firewall, and any upstream NAT or port-forward.
- Check that the server’s peer
AllowedIPscontains the client’s tunnel address and that the client routes traffic to the server peer.
The handshake works, but internet traffic fails
- Confirm
net.ipv4.ip_forward = 1is active. - Check that the MASQUERADE rule uses the actual outbound interface, not the illustrative
eth0name. - Verify forwarding policy in the host or cloud firewall.
- Check return routing and whether the client is actually using
0.0.0.0/0for an all-traffic design.
The peer reaches Ubuntu but not a LAN host
- Test the LAN host rather than stopping at the server’s tunnel address.
- Install a LAN return route for the tunnel subnet through Ubuntu, or use the internal-system proxy-ARP pattern when appropriate.
- Check the LAN host’s own firewall; it may reject traffic from the VPN subnet even when routing is correct.
Use evidence, not just an “up” status
sudo wg show reports handshake timing and transfer counters, while ip route shows where the kernel will send packets. A recent handshake with increasing counters, plus a successful test to a destination beyond the VPN endpoint, is a meaningful end-to-end check. An interface that merely exists is not.
How should I operate the server after installation?
Protect and back up identities
Back up configuration and private keys only in an encrypted, access-controlled location. Treat a server private-key disclosure as a replacement event: generate a new key pair, update every peer with the new public key, and remove the old identity from active configurations.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Add peers one at a time
Assign a documented tunnel address, generate a fresh key pair, add one [Peer] block, then test before adding the next client. This keeps duplicate AllowedIPs entries and address collisions easy to identify.
Keep routing changes persistent
The systemd unit persists the WireGuard interface, but forwarding and firewall/NAT persistence are separate. Ensure the sysctl file is loaded at boot and that your chosen firewall manager restores the MASQUERADE and forwarding policy after a restart.
What is the shortest safe installation checklist?
- Choose a non-overlapping tunnel subnet, topology, UDP port, and outbound interface.
- Install the Ubuntu WireGuard package.
- Generate unique server and peer key pairs under
umask 077. - Create
/etc/wireguard/wg0.confwith the server interface and one peer block per client. - Set file permissions to protect private keys and the configuration.
- Enable IPv4 forwarding when traffic must cross Ubuntu.
- Add MASQUERADE for internet egress, or install LAN return routes for a routed design.
- Enable proxy ARP only when the internal LAN design requires it.
- Bring up
wg0, inspectwg show, addresses, and routes. - Test a destination beyond Ubuntu, then run
sudo systemctl enable --now wg-quick@wg0.
Frequently Asked Questions
How do I stop WireGuard temporarily without deleting its configuration?
Run sudo wg-quick down wg0 to remove the live interface while leaving /etc/wireguard/wg0.conf intact. If systemd is managing it, use sudo systemctl disable --now wg-quick@wg0 when you also want to prevent the next boot from starting it.
Why can a client connect from one network but not another?
The tunnel may be fine while the new network blocks outbound UDP or uses a different NAT path. Compare the endpoint reachability and the latest handshake in sudo wg show; a changing client address is normally handled by having the client initiate toward the server rather than requiring a fixed server-side endpoint.
What does a recent handshake prove—and what does it not prove?
It proves that authenticated WireGuard packets exchanged successfully with that peer. It does not prove that forwarding, NAT, firewall policy, DNS, or a LAN’s return route is correct, so test an actual LAN or internet destination as well.
Can I add another Ubuntu WireGuard interface later?
Yes. Give the second interface a different name and file, such as wg1 and /etc/wireguard/wg1.conf, then manage it with wg-quick@wg1. Keep tunnel subnets, listen ports, and peer address assignments unambiguous so routes do not overlap.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
