How do I set up WireGuard on a VPS?

Which Gloamport plan runs a WireGuard server?

Ember is enough for a WireGuard server: Gloamport lists it for "A WireGuard VPN for a few devices". It has 1 vCPU, 1 GB of RAM and 1 TB of traffic a month, and WireGuard uses little of the first two.

According to Gloamport's survey of 10 November 2026, the median price of a comparable 1 vCPU, 1 GB VPS across 32 hosts was $10.55 a month. We do not claim to be the cheapest at every size; the point is that a VPN server does not need a large plan. Full KVM virtualization: your own kernel, your own firewall rules and your own disk encryption if you set it up. For the account side, see How do I buy a VPS with Monero (XMR)?.

How do I generate the keys and write the server config?

Generate keys with wg genkey and wg pubkey, with umask 077 set first so the private key file is readable only by root. The WireGuard quickstart gives the same one-liner used below.

apt update
apt install wireguard
umask 077
wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub
cat /etc/wireguard/server.pub

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <contents of /etc/wireguard/server.key>

[Peer]
# laptop
PublicKey = <public key of the laptop>
AllowedIPs = 10.8.0.2/32

How do I write the client config and start the tunnel?

Write a second file on the client with its own private key, the server public key and the VPS address, then bring it up with wg-quick up. The AllowedIPs line decides which traffic enters the tunnel: 10.8.0.0/24 sends only tunnel traffic, 0.0.0.0/0, ::/0 sends everything.

[Interface]
Address = 10.8.0.2/24
PrivateKey = <private key of the laptop>

[Peer]
PublicKey = <contents of server.pub>
Endpoint = <VPS IPv4 address>:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

# on the VPS
wg-quick up wg0
systemctl enable --now wg-quick@wg0
wg show

# on the laptop
wg-quick up wg0

How do I route all my traffic through the VPS?

To use the VPS as an exit for all your traffic, turn on IPv4 forwarding and add a masquerade rule on the server. The kernel documentation defines net.ipv4.ip_forward as the switch that forwards packets between interfaces, and its default is 0. The MASQUERADE target is valid only in the nat table, in the POSTROUTING chain.

Put both in the [Interface] section of the server file with PostUp and PostDown, which wg-quick runs in bash and where %i expands to the interface name. Find the public interface name first with ip route show default, then replace eth0 below.

PostUp = sysctl -w net.ipv4.ip_forward=1
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

How do I know the WireGuard tunnel works?

Run wg show on the server: a peer with a recent "latest handshake" and non-zero transfer counters is connected. If the handshake never appears, check that both public keys are on the right side, that the Endpoint address is the VPS IPv4 address, and that UDP 51820 is open.

Once it works, a 12-month Ember at $3.74 a month covers a personal VPN for a few devices, as the plan description says. Compare this route with a commercial one in Is a self-hosted VPN on a VPS better than a VPN service?. If the other end is a home server behind a carrier-grade NAT, continue with How do I connect my home network to a VPS with WireGuard (behind CGNAT)?. Then lock the VPS down with How do I harden SSH on a new VPS?.