Your own WireGuard VPN server, set up on a Cloud VPS in an evening

The pieces of a self-hosted WireGuard VPN

WireGuard wraps your internet traffic in encrypted UDP packets and sends them to a server you control. There is no account system and no login page: each device has a private key it keeps and a public key it hands out, the same idea as SSH keys. The server keeps a short list of the public keys it trusts and the inside address each one may use. Anything else is ignored.

• The server: a Linux machine with a public address and a wg0 network interface.
• A port: one UDP port open to the internet. WireGuard's examples use 51820.
• Forwarding and NAT: two settings that let the server hand your traffic on to the internet under its own address.
• Peers: your laptop, phone or a colleague's computer, each with its own keys and its own inside address.

Is a Cloud VPS enough for a VPN?

For yourself or a small team, yes. WireGuard runs inside the Linux kernel and is light on resources, so a few people's browsing is a small job. A Cloud VPS gives you a virtual machine in New York with root access, one IPv4 address and an IPv6 /96, and lists a VPN for you or your team among the jobs it suits. The processor is shared with other customers' machines, which matters for heavy computing, not for a few people's browsing.

• Any of the four Linux systems on offer will do; this guide uses Ubuntu.
• Paste your SSH key on the order page and log in as root once the machine is built, normally a couple of minutes after you pay.
• If a firewall change ever shuts you out, the console in your browser still gets you in.
• People answer on chat and phone at any hour if you get stuck.

How much traffic will your VPN use?

Roughly as much as you send and receive through it. Each size includes a monthly amount of outgoing traffic, and only what the machine sends is counted; what it receives is free. When you route all your browsing through the VPN, a film you stream arrives at the server for free and is then sent on to you, so it counts once. Files you upload are the opposite trip and also count once, on the way out to the internet.

Your traffic month starts on your billing day, not the 1st. If you only need to reach a few private machines rather than browse through the VPN, list just those addresses in the device's AllowedIPs and the rest of your traffic never touches the server.

Up and running in an evening

Work as root on the new machine. The commands follow WireGuard's install and quick-start pages, Ubuntu's own WireGuard guide and the ufw manual.

1. Install WireGuard, make the server's keys and switch on forwarding with the first box. Its last command, ip route show default, shows your public network interface after dev; write that name down, because the examples say eth0 and yours may differ.
2. The second box starts by creating /etc/wireguard/wg0.conf with only its [Interface] section. Before you run the box, replace every eth0 in it with your interface name: two in the config and one in the ufw route line. Your devices are added as peers later, in step 6.
3. Next in that box, SSH is let through the firewall before anything else, so turning the firewall on cannot cut you off.
4. The following ufw lines open the VPN port, let tunnel traffic out to the internet and switch the firewall on.
5. The box's last line starts WireGuard and has it come back after every reboot.
6. Set up your first device (next section), add a [Peer] block with its public key to the server's wg0.conf and reload WireGuard with systemctl reload wg-quick@wg0.

apt update && apt install wireguard
umask 077
wg genkey > /etc/wireguard/gateway.key
wg pubkey < /etc/wireguard/gateway.key > /etc/wireguard/gateway.pub
cat /etc/wireguard/gateway.pub

# allow the server to pass packets between wg0 and the internet
echo 'net.ipv4.ip_forward = 1' > /etc/sysctl.d/70-wireguard-routing.conf
sysctl -p /etc/sysctl.d/70-wireguard-routing.conf
ip route show default

cat > /etc/wireguard/wg0.conf <<'EOF'
[Interface]
Address = 10.66.66.1/24
ListenPort = 51820
PostUp = wg set %i private-key /etc/wireguard/gateway.key
PostUp = iptables -t nat -A POSTROUTING -s 10.66.66.0/24 -o eth0 -j MASQUERADE
PreDown = iptables -t nat -D POSTROUTING -s 10.66.66.0/24 -o eth0 -j MASQUERADE
EOF

# firewall: SSH first, then the VPN port and forwarding
ufw allow 22/tcp
ufw allow 51820/udp
ufw route allow in on wg0 out on eth0
ufw enable

systemctl enable --now wg-quick@wg0

The PostUp lines run when the tunnel starts: the first loads the private key from its own file, so you can show someone the config without giving away the secret; the second shares the server's address with your devices. PreDown tidies that rule away when the tunnel stops.

Connecting your laptop and phone

Install WireGuard on the device from the project's install page (there are apps for Windows, macOS, iOS and Android), let it create a key pair, and give it a config like this one. The server's public key is the line cat printed earlier.

[Interface]
PrivateKey = THE_LAPTOP_PRIVATE_KEY
Address = 10.66.66.2/24

[Peer]
PublicKey = THE_GATEWAY_PUBLIC_KEY
Endpoint = YOUR_VPS_IPV4:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

• AllowedIPs = 0.0.0.0/0 sends all of the device's IPv4 traffic through the server.
• PersistentKeepalive = 25 keeps home and mobile routers from forgetting the connection; WireGuard's quick-start names 25 seconds as an interval that works with most firewalls.
• To see whether it worked, run wg show on the server. A recent latest handshake under your device means you are connected.
• Your device may still look up website names through the network you are sitting on. Add a DNS line with a resolver you trust to the device's config to stop that.

Adding the next person

Every device gets its own keys and the next free inside address: 10.66.66.3, then .4, and so on. Copy a [Peer] block in the server's file, paste the new public key, change the address, then reload WireGuard with systemctl reload wg-quick@wg0; a reload adds the person without disconnecting anyone already on.

• For a phone, Ubuntu's guide shows how to print a scannable QR code from the config using qrencode, so the app reads it in one go. Put the phone's private key directly in that config, and treat the QR code as a secret: anyone who scans it has the phone's key. Delete the file from the server afterwards.
• Do not reuse one key on two devices. To remove someone, delete their block and reload.
• For an extra layer of protection, wg genpsk makes a preshared key that both ends add to their peer sections.
• Run apt upgrade regularly; WireGuard updates arrive with the rest of Ubuntu.

When you'll want something bigger

The Cloud VPS lives in New York, so websites will see you browsing from New York. If you need to appear somewhere else, or your whole team works through the VPN all day and keeps running out of monthly traffic, a whole server on a port nobody meters is the better fit, in any of our five data centers. A VPN is also a good way to keep private tools off the open internet, such as a Nextcloud server for your team's files that only answers inside the tunnel.

Questions people ask

Am I allowed to run a VPN on a Primcast Cloud VPS?

Yes. VPNs are allowed on every size, and a VPN for yourself or your team is one of the jobs the Cloud VPS page suggests it for. Our terms of service still apply to the traffic it carries.

Do I need port 51820?

No, any free UDP port works, as long as the server's ListenPort, the firewall rule and each device's Endpoint all use the same number. 51820 is simply the one WireGuard's own examples use. Do set it; if you leave ListenPort out, the server picks a random port each time it starts.

What happens if my VPN uses up the month's traffic?

Nothing stops. The server keeps running and keeps receiving at full speed, but sends at 10 Mbit/s until your next month begins. Since everything you download through the VPN is sent by the server, browsing slows to that speed. You can add traffic from the dashboard to get full speed back sooner.

Does this work from my phone?

Yes. WireGuard has official apps for iOS and Android. Create the phone's config on the server, show it as a QR code with qrencode, and scan it in the app.

Will it carry my IPv6 traffic too?

Not with the configs on this page, which tunnel IPv4 only. The VPS does come with an IPv6 /96, so you can extend the setup: give wg0 IPv6 addresses, add ::/0 to the device's AllowedIPs, and set up IPv6 forwarding and firewall rules to match.

What if I break SSH while setting up the firewall?

Open the console in your browser from the Virtual Machines tab, log in as root and undo the rule. The root password is in your dashboard, and our team is on chat and phone at any hour if you need a hand.