How to Set Up a VPN on a VPS (WireGuard)

Running a VPN on your own VPS gives you a private tunnel with your own server's address, and it costs a few dollars a year. This guide uses WireGuard, which is fast, small and much simpler to set up than OpenVPN. It works on a KVM VPS running a recent Debian or Ubuntu. Check RackNerd's terms of service before you build on a plan. Why a VPS rather than a VPN service? See Why a VPS is better than a VPN.

Step 1: Install WireGuard on the server

sudo apt update
sudo apt install wireguard
wg genkey | sudo tee /etc/wireguard/server.key | wg pubkey | sudo tee /etc/wireguard/server.pub

Step 2: Create a key pair for your device

Do the same on the device you will connect from (or run these on the server and copy the results):

wg genkey | tee client.key | wg pubkey > client.pub

Step 3: Write the server config

Create /etc/wireguard/wg0.conf. Replace eth0 with your network interface if it differs (check with ip route), and fill in the two keys:

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = (contents of server.key)
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = (contents of client.pub)
AllowedIPs = 10.8.0.2/32

Make the file private with sudo chmod 600 /etc/wireguard/wg0.conf.

Step 4: Allow forwarding and open the port

echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-wireguard.conf
sudo sysctl --system
sudo ufw allow 51820/udp

Step 5: Start it

sudo systemctl enable --now wg-quick@wg0
sudo wg show

Step 6: Set up your device

Install the WireGuard app on your phone or computer and create a tunnel with this config:

[Interface]
PrivateKey = (contents of client.key)
Address = 10.8.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = (contents of server.pub)
Endpoint = YOUR_SERVER_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Connect, then check your address on a site such as whatismyip.com. It should show your VPS's IP address.

What about OpenVPN?

OpenVPN also works well and is supported almost everywhere, but it needs a certificate authority and more configuration. If you want it, follow the OpenVPN how-to, or use a well-known install script. WireGuard is the easier place to start.

Choosing a plan

A VPN needs very little CPU and RAM. Pick a location where you want to appear from, and check the monthly bandwidth: all your VPN traffic counts against it. See which RackNerd VPS suits a VPN.