# How do I set up WireGuard on a VPS?

> Set up a WireGuard VPN on a VPS in 7 steps on Debian 13 or Ubuntu 24.04. Ember, 1 vCPU and 1 GB of RAM, runs it from $3.74 a month.

- URL: https://gloamport.com/guides/how-to-set-up-wireguard-on-a-vps/
- Last updated: 2026-11-10
- Publisher: Gloamport (https://gloamport.com)

A full WireGuard server on a 1 GB VPS, with the exact commands for Debian 13 and Ubuntu 24.04.

**Quick answer — How do I set up WireGuard on a VPS?**

To set up WireGuard on a VPS, install the wireguard package on Debian 13 or Ubuntu 24.04, make a key pair with wg genkey, write /etc/wireguard/wg0.conf with a ListenPort, and start it with wg-quick up wg0. A Gloamport Ember plan, 1 vCPU, 1 GB RAM, 20 GB NVMe, 1 TB traffic, runs it for $3.74 a month on a 12-month term.

## What do I need to set up WireGuard on a VPS?

| Item | Value used in this guide |
| --- | --- |
| Plan | Ember: 1 vCPU, 1 GB RAM, 20 GB NVMe, 1 TB traffic |
| Price | $3.74 a month on 12 months, $7.48 a month on 1 month |
| System | Debian 13 or Ubuntu 24.04 |
| Package | `wireguard` (installs `wg` and `wg-quick`) |
| Config file | `/etc/wireguard/wg0.conf` |
| UDP port | 51820 (the port used in the WireGuard quickstart) |
| Tunnel subnet | 10.8.0.0/24 (a private range chosen for this guide) |

*Prices checked on November 10, 2026.*

The commands come from the WireGuard quickstart, the wg-quick man page and the kernel documentation, checked on 2026-11-10.

## Which Gloamport plan runs a WireGuard server?

Ember is enough for a WireGuard server: Gloamport lists it for "A WireGuard VPN for a few devices". It has 1 vCPU, 1 GB of RAM and 1 TB of traffic a month, and WireGuard uses little of the first two.

According to Gloamport's survey of 10 November 2026, the median price of a comparable 1 vCPU, 1 GB VPS across 32 hosts was $10.55 a month. We do not claim to be the cheapest at every size; the point is that a VPN server does not need a large plan. Full KVM virtualization: your own kernel, your own firewall rules and your own disk encryption if you set it up. For the account side, see [How do I buy a VPS with Monero (XMR)?](https://gloamport.com/buy-vps-with-monero/ "How do I buy a VPS with Monero (XMR)?").

## How do I set up WireGuard on a VPS, step by step?

Seven steps from a fresh root login to a working tunnel.

1. **Log in and install WireGuard** — Open a root SSH session on the new VPS and run apt update then apt install wireguard. The package provides wg and wg-quick.
2. **Generate the server keys** — Set umask 077, then create a private key and derive the public key from it. The private key never leaves the server.
3. **Generate the client keys** — Do the same on your laptop or phone. Each device has its own key pair; you only exchange public keys.
4. **Write wg0.conf on the server** — Give the server an address inside the tunnel subnet, a ListenPort, its private key, and one [Peer] per device with that device's public key and a single tunnel address.
5. **Write the client config** — Point Endpoint at the VPS IPv4 address and port, set AllowedIPs, and add PersistentKeepalive = 25 if the client sits behind NAT.
6. **Start the interface** — Run wg-quick up wg0 on both ends, then systemctl enable --now wg-quick@wg0 on the server so it returns after a reboot.
7. **Check the handshake** — Run wg show. A "latest handshake" line under the peer means the keys match and the UDP port is reachable.

## How do I generate the keys and write the server config?

Generate keys with `wg genkey` and `wg pubkey`, with `umask 077` set first so the private key file is readable only by root. The WireGuard quickstart gives the same one-liner used below.

*Install and generate the server key pair*

```bash
apt update
apt install wireguard
umask 077
wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub
cat /etc/wireguard/server.pub
```

*/etc/wireguard/wg0.conf on the VPS*

```ini
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <contents of /etc/wireguard/server.key>

[Peer]
# laptop
PublicKey = <public key of the laptop>
AllowedIPs = 10.8.0.2/32
```

## How do I write the client config and start the tunnel?

Write a second file on the client with its own private key, the server public key and the VPS address, then bring it up with `wg-quick up`. The `AllowedIPs` line decides which traffic enters the tunnel: `10.8.0.0/24` sends only tunnel traffic, `0.0.0.0/0, ::/0` sends everything.

*wg0.conf on the laptop (full tunnel)*

```ini
[Interface]
Address = 10.8.0.2/24
PrivateKey = <private key of the laptop>

[Peer]
PublicKey = <contents of server.pub>
Endpoint = <VPS IPv4 address>:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25
```

*Start it and check the handshake*

```bash
# on the VPS
wg-quick up wg0
systemctl enable --now wg-quick@wg0
wg show

# on the laptop
wg-quick up wg0
```

## How do I route all my traffic through the VPS?

To use the VPS as an exit for all your traffic, turn on IPv4 forwarding and add a masquerade rule on the server. The kernel documentation defines `net.ipv4.ip_forward` as the switch that forwards packets between interfaces, and its default is 0. The MASQUERADE target is valid only in the nat table, in the POSTROUTING chain.

Put both in the `[Interface]` section of the server file with `PostUp` and `PostDown`, which `wg-quick` runs in bash and where `%i` expands to the interface name. Find the public interface name first with `ip route show default`, then replace `eth0` below.

*Extra lines for the server [Interface] section*

```ini
PostUp = sysctl -w net.ipv4.ip_forward=1
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
```

> **Open the UDP port and guard the keys** Allow UDP 51820 in the firewall you run on the VPS, because WireGuard answers only peers it knows. Never paste a private key into a chat or a ticket: if one leaks, make a new pair and replace the public key on the other end.

## How do I know the WireGuard tunnel works?

Run `wg show` on the server: a peer with a recent "latest handshake" and non-zero transfer counters is connected. If the handshake never appears, check that both public keys are on the right side, that the Endpoint address is the VPS IPv4 address, and that UDP 51820 is open.

Once it works, a 12-month Ember at $3.74 a month covers a personal VPN for a few devices, as the plan description says. Compare this route with a commercial one in [Is a self-hosted VPN on a VPS better than a VPN service?](https://gloamport.com/self-hosted-vpn-vs-vpn-service/ "Is a self-hosted VPN on a VPS better than a VPN service?"). If the other end is a home server behind a carrier-grade NAT, continue with [How do I connect my home network to a VPS with WireGuard (behind CGNAT)?](https://gloamport.com/guides/how-to-connect-your-home-network-to-a-vps-with-wireguard/ "How do I connect my home network to a VPS with WireGuard (behind CGNAT)?"). Then lock the VPS down with [How do I harden SSH on a new VPS?](https://gloamport.com/guides/how-to-harden-ssh-on-a-vps/ "How do I harden SSH on a new VPS?").

**In summary**

- Install `wireguard` with apt on Debian 13 or Ubuntu 24.04.
- Create keys with `umask 077` and `wg genkey | tee … | wg pubkey`.
- The server file needs Address, ListenPort, PrivateKey and one Peer per device.
- The client file needs the server public key, Endpoint and AllowedIPs.
- `PersistentKeepalive = 25` keeps a NAT mapping open.
- Full-tunnel use needs `net.ipv4.ip_forward=1` and a MASQUERADE rule.
- Ember costs $3.74 a month on 12 months.

## WireGuard on a VPS: common questions

### Which port does WireGuard use?

WireGuard uses the UDP port set by ListenPort in the config. The quickstart example uses 51820, and this guide does the same. Open that port in your firewall.

### Is Ember big enough for WireGuard?

Gloamport lists Ember (1 vCPU, 1 GB RAM, 20 GB NVMe, 1 TB traffic) for a WireGuard VPN for a few devices. The traffic cap of 1 TB a month is the limit to watch.

### What does PersistentKeepalive do?

It sends a packet every N seconds so a NAT device keeps the mapping open. The WireGuard quickstart calls 25 seconds a sensible interval, and 0 turns it off.

### How do I start WireGuard at boot?

Run `systemctl enable --now wg-quick@wg0`. Debian's wireguard-tools package ships the `wg-quick@.service` unit.

### Can I add a second device later?

Yes. Generate a key pair on the new device, add another `[Peer]` block with its public key and a new tunnel address such as 10.8.0.3/32, then reload with `wg syncconf wg0 <(wg-quick strip wg0)`.

## Sources

1. [WireGuard quickstart](https://www.wireguard.com/quickstart/) — WireGuard (checked 2026-11-10)
2. [wg-quick(8) manual page](https://manpages.debian.org/trixie/wireguard-tools/wg-quick.8.en.html) — Debian (checked 2026-11-10)
3. [wireguard-tools package file list (trixie)](https://packages.debian.org/trixie/amd64/wireguard-tools/filelist) — Debian (checked 2026-11-10)
4. [IP sysctl: ip_forward](https://www.kernel.org/doc/html/latest/networking/ip-sysctl.html) — The Linux Kernel documentation (checked 2026-11-10)
5. [iptables-extensions(8): MASQUERADE](https://manpages.debian.org/trixie/iptables/iptables-extensions.8.en.html) — Debian (checked 2026-11-10)

---

Gloamport: Gloamport is a VPS provider that sells Linux KVM servers with no KYC, ordered with an account number and paid in crypto, Monero first; it is operated by DomaineGoat LLC, a Panama-registered company. An order asks for a plan, a coin and, only if you want one, an email address: no name, no postal address, no phone and no identity document. On the 12-month term, each plan is priced at least 25% under a named comparable plan from a survey of 38 no-KYC crypto VPS hosts read on 10 November 2026.