Learn Linux with Alice
Setting up a WireGuard VPN Server on Ubuntu: A Comprehensive Guide

Setting up a WireGuard VPN Server on Ubuntu: A Comprehensive Guide

Posted on by Robert Johnson

Setting up a WireGuard VPN Server on Ubuntu: A Comprehensive Guide

In this guide, we’ll walk you through setting up a WireGuard VPN server on Ubuntu. WireGuard is a modern, fast, and secure VPN protocol that is easy to configure and use. This tutorial is designed for beginners, so no prior VPN experience is required.

Why Choose WireGuard?

WireGuard offers several advantages over traditional VPN protocols like OpenVPN and IPsec:

  • Speed: WireGuard is significantly faster due to its streamlined codebase and modern cryptography.
  • Security: WireGuard uses state-of-the-art encryption algorithms, ensuring a secure connection.
  • Simplicity: WireGuard’s configuration is much simpler than other VPN protocols.
  • Modernity: It’s a newer protocol built with modern needs in mind.

Prerequisites

Before you begin, you’ll need the following:

  • An Ubuntu server (20.04 or later). A VPS from RackNerd is a great option. They offer VPS solutions starting from $15/year.
  • A user account with sudo privileges.
  • A domain name (optional, but recommended for easy access).

Step 1: Install WireGuard

First, update your server’s package list:


sudo apt update

Then, install the WireGuard package:


sudo apt install wireguard

Step 2: Generate Keys

WireGuard uses public and private key pairs for authentication. Generate these keys for both the server and each client. On the server, run:


wg genkey | tee privatekey | wg pubkey > publickey

This will create two files: privatekey and publickey. These files contain the server’s private and public keys, respectively. Keep the private key secret!

Step 3: Configure the WireGuard Interface

Create a new WireGuard interface configuration file:


sudo nano /etc/wireguard/wg0.conf

Add the following configuration to the file, replacing [SERVER_PRIVATE_KEY] with the contents of the privatekey file:


[Interface]
PrivateKey = [SERVER_PRIVATE_KEY]
Address = 10.6.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Explanation:

  • PrivateKey: The server’s private key.
  • Address: The server’s IP address within the WireGuard network.
  • ListenPort: The port WireGuard will listen on.
  • PostUp: Commands to execute after the interface is brought up (enables forwarding).
  • PostDown: Commands to execute after the interface is brought down (disables forwarding).

Enable IP forwarding:


sudo nano /etc/sysctl.conf

Uncomment the line net.ipv4.ip_forward=1 and save the file. Then, apply the changes:


sudo sysctl -p

Step 4: Configure the Client

On your client device (e.g., your laptop), install the WireGuard client. The installation process varies depending on your operating system. Refer to the WireGuard website for instructions.

Generate a key pair for the client:


wg genkey | tee privatekey | wg pubkey > publickey

Create a client configuration file (e.g., wg0.conf) with the following content, replacing [CLIENT_PRIVATE_KEY] with the client’s private key, [SERVER_PUBLIC_KEY] with the server’s public key, and [SERVER_IP] with the server’s public IP address:


[Interface]
PrivateKey = [CLIENT_PRIVATE_KEY]
Address = 10.6.0.2/32
DNS = 8.8.8.8, 8.8.4.4
[Peer]
PublicKey = [SERVER_PUBLIC_KEY]
Endpoint = [SERVER_IP]:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Explanation:

  • PrivateKey: The client’s private key.
  • Address: The client’s IP address within the WireGuard network.
  • DNS: The DNS servers to use.
  • PublicKey: The server’s public key.
  • Endpoint: The server’s public IP address and port.
  • AllowedIPs: The IP addresses to route through the VPN. 0.0.0.0/0 routes all traffic.
  • PersistentKeepalive: Sends a keepalive packet every 25 seconds to keep the connection alive.

Step 5: Add the Client to the Server Configuration

Back on the server, add the client’s configuration to the /etc/wireguard/wg0.conf file:


[Peer]
PublicKey = [CLIENT_PUBLIC_KEY]
AllowedIPs = 10.6.0.2/32

Replace [CLIENT_PUBLIC_KEY] with the client’s public key.

Step 6: Start the WireGuard Interface

Start the WireGuard interface on the server:


sudo wg-quick up wg0

Enable the interface to start on boot:


sudo systemctl enable wg-quick@wg0

Step 7: Connect the Client

On your client device, activate the WireGuard connection using the configuration file you created. The exact method varies depending on your operating system.

Step 8: Test the Connection

Once connected, verify that your traffic is being routed through the VPN. You can use a website like whatismyip.com to check your IP address.

Troubleshooting

  • Connection issues: Ensure that the server’s firewall is allowing traffic on port 51820 (UDP).
  • DNS resolution problems: Double-check the DNS settings in your client configuration.
  • Routing problems: Verify that IP forwarding is enabled on the server.

Congratulations! You have successfully set up a WireGuard VPN server on Ubuntu. Enjoy your secure and private connection.

For more information on Linux server administration, check out our other tutorials on cavecreekcoffee.com.

Consider getting a cheap VPS from RackNerd. They offer VPS solutions starting from $15/year. They have servers with up to 6gb of RAM for ~$50/year.

Advanced Configuration Options

Using a Firewall

It’s crucial to properly configure your firewall to allow WireGuard traffic. If you’re using ufw, you can use the following commands:


sudo ufw allow 51820/udp
sudo ufw enable

Using DNSMasq for Local DNS Resolution

If you want to resolve local hostnames within your VPN, you can use DNSMasq. Install DNSMasq:


sudo apt install dnsmasq

Configure DNSMasq to listen on the WireGuard interface. Add the following line to /etc/dnsmasq.conf:


interface=wg0

Restart DNSMasq:


sudo systemctl restart dnsmasq

Then, set the DNS server in your client configuration to the server’s WireGuard IP address (10.6.0.1):


DNS = 10.6.0.1

Using a Custom Port

While 51820 is the default port, you can use any other UDP port for WireGuard. Just make sure to update the ListenPort in the server configuration and the Endpoint in the client configuration accordingly.

Securing Your WireGuard Server

Disabling Unnecessary Services

To reduce the attack surface, disable any unnecessary services on your server. Use systemctl to stop and disable services that you don’t need.

Using SSH Key Authentication

Disable password authentication for SSH and use SSH key authentication instead. This makes it much harder for attackers to gain access to your server.

Keeping Your Server Updated

Regularly update your server’s packages to patch security vulnerabilities:


sudo apt update && sudo apt upgrade

Using Fail2ban

Fail2ban can help protect your server from brute-force attacks. Install Fail2ban:


sudo apt install fail2ban

Configure Fail2ban to monitor SSH logs and block attackers who try to brute-force your SSH password.

Troubleshooting Common Issues

Client Cannot Connect

If the client cannot connect, check the following:

  • Ensure that the server’s firewall is allowing traffic on the WireGuard port (51820 UDP by default).
  • Verify that the client’s public key is added to the server’s configuration file.
  • Double-check the client’s configuration file for typos.
  • Make sure that the server’s IP address is correct in the client’s configuration file.

No Internet Access

If the client can connect to the VPN but has no internet access, check the following:

  • Verify that IP forwarding is enabled on the server.
  • Ensure that the PostUp and PostDown rules in the server’s configuration file are correct.
  • Double-check the AllowedIPs setting in the client’s configuration file. It should be set to 0.0.0.0/0 to route all traffic through the VPN.

Slow Connection Speed

If the connection speed is slow, try the following:

  • Experiment with different WireGuard ports. Some ports may be congested.
  • Increase the PersistentKeepalive interval. This can help keep the connection alive.
  • Check the server’s CPU and memory usage. If the server is overloaded, it may be affecting the connection speed.

Conclusion

Setting up a WireGuard VPN server on Ubuntu is a relatively straightforward process. By following the steps outlined in this guide, you can create a secure and private connection for your devices. Remember to take the necessary security precautions to protect your server from attack. And if you’re looking for a reliable and affordable VPS, check out RackNerd. They offer a variety of VPS solutions to meet your needs.

Using WireGuard with Docker

You can also run a WireGuard VPN server in a Docker container. This can be useful for isolating the VPN server from the rest of your system.

First, create a Dockerfile:


FROM ubuntu:latest
RUN apt update && apt install -y wireguard iptables
COPY wg0.conf /etc/wireguard/wg0.conf
ENTRYPOINT wg-quick up wg0

Replace wg0.conf with your WireGuard server configuration file.

Then, build the Docker image:


docker build -t wireguard .

Run the Docker container:


docker run -d --cap-add=NET_ADMIN -v /lib/modules:/lib/modules:ro -p 51820:51820/udp wireguard

Explanation:

  • --cap-add=NET_ADMIN: Allows the container to modify network interfaces.
  • -v /lib/modules:/lib/modules:ro: Mounts the host’s kernel modules into the container.
  • -p 51820:51820/udp: Exposes the WireGuard port.

You’ll also need to ensure that the Docker container can forward traffic. You can do this by adding the following lines to your server’s sysctl.conf file:


net.ipv4.ip_forward=1
net.ipv4.conf.all.proxy_arp=1

Then, apply the changes:


sudo sysctl -p

Expanding on Key Generation

The key generation process is critical for security. When generating keys, ensure that you are using a strong random number generator. On most Linux systems, /dev/urandom is a good source of randomness. The wg genkey command uses this by default.

It is also important to store your private keys securely. Do not share your private keys with anyone. If a private key is compromised, generate a new key pair immediately.

More Troubleshooting Tips

MTU Issues

Sometimes, the Maximum Transmission Unit (MTU) can cause problems with WireGuard. If you are experiencing connectivity issues, try reducing the MTU on the client interface. You can do this by adding the following line to the client configuration file:


MTU = 1420

Experiment with different MTU values until you find one that works.

Firewall Conflicts

Ensure that your firewall is not blocking WireGuard traffic. If you are using a firewall other than ufw, consult its documentation for instructions on how to allow UDP traffic on port 51820.

Kernel Module Issues

In rare cases, the WireGuard kernel module may not be loaded correctly. You can try loading the module manually:


sudo modprobe wireguard

If this resolves the issue, you can configure the module to load automatically on boot by adding wireguard to /etc/modules.