WireGuard server config: wg0.conf example and generator
Set up a WireGuard VPN server on Linux with one peer, NAT and the right commands.
This is the file for the WireGuard server. Generate the keys on your machine first, then paste them in. Your keys stay in your browser, and it is safest to leave the placeholders and paste the real private key locally.
Create your config file
Type your own values. The file below updates as you type, and nothing you type leaves your browser.
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = PASTE_SERVER_PRIVATE_KEY
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
[Peer]
PublicKey = PASTE_CLIENT_PUBLIC_KEY
AllowedIPs = 10.8.0.2/32How this setup works
Step-by-step setup
- Install it: sudo apt install wireguard.
- Make the keys: wg genkey | tee server_private.key | wg pubkey > server_public.key. Do the same on each client.
- Save the config as /etc/wireguard/wg0.conf and lock it: sudo chmod 600 /etc/wireguard/wg0.conf.
- Turn on forwarding: echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-wireguard.conf && sudo sysctl --system.
- Open the port: sudo ufw allow 51820/udp.
- Start it: sudo systemctl enable --now wg-quick@wg0, then check with sudo wg show.
What the important lines mean
- Address is the server’s own address inside the VPN: 10.8.0.1/24.
- PrivateKey never leaves the server. Share only public keys.
- AllowedIPs for a peer is the address that peer may use: 10.8.0.2/32.
- The PostUp lines turn on NAT so clients can reach the internet through the server.
Common errors and how to fix them
- No handshake
- Check that the keys are not swapped, the client uses the right endpoint and port, and UDP 51820 is open on the server and any cloud firewall.
- Handshake works but there is no internet
- Forwarding or NAT is off. Check ip_forward and that eth0 is your real network interface.
- RTNETLINK answers: Operation not supported
- The kernel has no WireGuard module. Some container-based VPS plans do not allow it.
- Config file permissions are too open
- Run sudo chmod 600 on the file. wg-quick warns about world-readable keys.
Frequently asked questions
- How do I generate WireGuard keys?
- Run wg genkey, and pipe it into wg pubkey for the public key. Each side makes its own pair.
- Is it safe to paste my private key into a web page?
- The key stays in your browser here, but the safest habit is to leave the placeholder and paste the real key into the file on your server.
- Which port does WireGuard use?
- 51820 UDP is the usual choice, but any free UDP port works.
Free tools that help
- Common ports listSearch a list of common TCP and UDP port numbers: SSH 22, HTTP 80, HTTPS 443, MySQL 3306, PostgreSQL 5432 and more, with dev server ports.
- Subnet calculatorEnter an IPv4 address with a prefix or netmask to get the network, broadcast, host range, wildcard mask and usable hosts. Split into subnets.
Fix a problem with this setup
- Open from your phonelocalhost only means “this device”. Use your computer’s IP address and start the server on all network addresses.
More server configs
- WireGuard client configCreate the client file that connects to your WireGuard server, with DNS, allowed IPs and keepalive.
- nginx HTTPS server blockServe your site over HTTPS with nginx: certificate paths, HTTP to HTTPS redirect, HSTS and a proxy or static site.
- .htaccess fileBuild an Apache .htaccess file with an HTTPS redirect, www rules, compression, caching and a front controller.
- robots.txt fileCreate a robots.txt that tells search engines what to crawl, with a sitemap line and optional AI crawler blocks.
- nginx redirect www to non-wwwSend www.example.com to example.com (or the reverse) with one permanent redirect.
- nginx load balancer configSplit traffic across two or three copies of your app with an nginx upstream block.