What does AllowedIPs do on a client?

It chooses which destinations go through the VPN. 0.0.0.0/0 means everything.

Do I need a DNS line?

Not always. Without it your device keeps its own DNS, which can leak your lookups when all traffic is tunnelled.

Why PersistentKeepalive?

It sends a small packet regularly so a home router keeps the connection open.

WireGuard client config: example for your phone or laptop

Create the client file that connects to your WireGuard server, with DNS, allowed IPs and keepalive.

For devices running WireGuard: Linux, Windows, macOS, iOS and Android.

This is the file for the device that connects to your WireGuard server. Enter the server’s public key and address. Use 0.0.0.0/0 to send all traffic through the VPN, or just the VPN network to reach your home or office only.

Create your config file

Type your own values. The file below updates as you type, and nothing you type leaves your browser.

wg0.conf

[Interface]
PrivateKey = PASTE_CLIENT_PRIVATE_KEY
Address = 10.8.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = PASTE_SERVER_PUBLIC_KEY
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

How this setup works

Diagram: Your device, then Encrypted tunnel, then Server — Your device (has the client file) → Encrypted tunnel (UDP to the server) → Server (sends traffic on)

Step-by-step setup

On the client, make the keys: wg genkey | tee client_private.key | wg pubkey > client_public.key.
Give the client public key to the server and add it as a peer.
Save this config as wg0.conf.
Linux: copy it to /etc/wireguard/ and run sudo wg-quick up wg0. On a phone or desktop app, import the file or scan its QR code.
Check the connection with sudo wg show and look for a recent handshake.

What the important lines mean

Endpoint is where the server listens: vpn.example.com:51820.
AllowedIPs decides which traffic uses the tunnel: 0.0.0.0/0, ::/0.
PersistentKeepalive helps when the client is behind a home router (NAT).

Common errors and how to fix them

No handshake: The keys do not match, the endpoint is wrong, or UDP is blocked. Check the server’s public key and that the server lists this client as a peer.
The connection works but websites do not load: DNS or routing. Check the DNS server, and that the server forwards traffic with NAT.
I lost access to my home network: With 0.0.0.0/0 all traffic goes through the tunnel. Use the VPN network range only if you just need the VPN.
Name or service not known: The endpoint name does not resolve. Use the server’s IP address or fix the DNS record.

Frequently asked questions

What does AllowedIPs do on a client?: It chooses which destinations go through the VPN. 0.0.0.0/0 means everything.
Do I need a DNS line?: Not always. Without it your device keeps its own DNS, which can leak your lookups when all traffic is tunnelled.
Why PersistentKeepalive?: It sends a small packet regularly so a home router keeps the connection open.

Written for: WireGuard 1.0, Ubuntu 24.04 · Updated 2026-10-03

Free tools that help

Subnet calculatorEnter an IPv4 address with a prefix or netmask to get the network, broadcast, host range, wildcard mask and usable hosts. Split into subnets.

More server configs

nginx HTTPS server blockServe your site over HTTPS with nginx: certificate paths, HTTP to HTTPS redirect, HSTS and a proxy or static site.
.htaccess fileBuild an Apache .htaccess file with an HTTPS redirect, www rules, compression, caching and a front controller.
robots.txt fileCreate a robots.txt that tells search engines what to crawl, with a sitemap line and optional AI crawler blocks.
nginx redirect www to non-wwwSend www.example.com to example.com (or the reverse) with one permanent redirect.
nginx load balancer configSplit traffic across two or three copies of your app with an nginx upstream block.
nginx rate limit configSlow down abusive visitors with limit_req: a request rate per IP, a burst, and a 429 answer.

See all 41 config generators