Security & Firewalls Intermediate 20 min

How to Set Up a Fast WireGuard VPN Server on Ubuntu 24.04

Create an encrypted, low-latency private VPN tunnel for secure remote administration and anonymous browsing

IndSoft Cloud Engineering
Reviewed October 2026
Production Verified Commands

Guide Overview & Architecture Outcome

By following this guide, you will deploy a high-speed WireGuard VPN server on Ubuntu 24.04. You will configure IPv4 forwarding, set up cryptographic peer keys, and connect client devices with minimal overhead.

Table of Contents
Step 1: Install WireGuard Utilities and Enab... Step 2: Generate Server and Client Keypairs... Step 3: Configure /etc/wireguard/wg0.conf an... Check That It Worked Troubleshooting
Practice on Live Cloud

Spin up an Ubuntu 24.04 instance with instant activation to test this tutorial:

Deploy IndSoft VPS

Prerequisites & System Requirements

An Ubuntu 24.04 VPS with public IPv4. Recommended: IndSoft Low-Latency VPS.

1

Install WireGuard Utilities and Enable IP Forwarding

Install WireGuard tools and permit packet forwarding in the Linux kernel.

bash · step-1-command.sh
sudo apt update && sudo apt install wireguard -y echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.conf sudo sysctl -p
Expected System Output:
net.ipv4.ip_forward = 1
2

Generate Server and Client Keypairs

Generate private and public keys with strict 600 permissions.

bash · step-2-command.sh
umask 077 wg genkey | tee server_private.key | wg pubkey > server_public.key wg genkey | tee client_private.key | wg pubkey > client_public.key
Expected System Output:
Keys generated.
3

Configure /etc/wireguard/wg0.conf and Start Interface

Define the VPN subnet, listening port 51820, and iptables NAT forwarding rules.

bash · step-3-command.sh
sudo nano /etc/wireguard/wg0.conf # [Interface] Address = 10.0.0.1/24, ListenPort = 51820, PrivateKey = ... # PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE sudo systemctl start wg-quick@wg0 sudo systemctl enable wg-quick@wg0
Expected System Output:
Interface wg0 started.

Check That It Worked (Verification)

Run this quick verification check to confirm your installation is responding properly:

verify-service.sh
sudo wg show
Expected Response:
interface: wg0 public key: h9s87f... listening port: 51820 peer: aK98sd... endpoint: 198.51.100.2:51820 transfer: 4.82 MiB received, 18.29 MiB sent

Troubleshooting Common Errors

Quick resolutions for frequent setup pitfalls and configuration issues.

Diagnostic Tips
No internet access when connected to VPN
Ensure iptables NAT masquerading rule matches your active network interface name: check with ip route show default.
WireGuard port blocked by cloud firewall
Ensure UDP port 51820 is permitted in UFW: sudo ufw allow 51820/udp.
DNS leaks on client
Specify trusted DNS resolvers in the client configuration file: DNS = 1.1.1.1, 8.8.8.8.