Set up a WireGuard VPN server: key generation, server and client configuration, IP forwarding, firewall rules, and Windows/Linux/Android client setup guide.
WireGuard is a modern, fast, and secure VPN protocol. Compared to OpenVPN and IPSec, it has a much simpler structure and delivers high performance. This guide walks you through setting up a WireGuard VPN server on your REXE server so clients can establish secure connections.
# Ubuntu 20.04+
sudo apt update
sudo apt install wireguard -y
# CentOS/AlmaLinux 8+
sudo dnf install epel-release -y
sudo dnf install wireguard-tools -y
# Debian 11+
sudo apt install wireguard -y
WireGuard uses a key pair (private + public) for each server and client.
# Generate server keys
cd /etc/wireguard
# Generate private key
wg genkey | sudo tee /etc/wireguard/server_private.key
# Derive public key
sudo cat /etc/wireguard/server_private.key | wg pubkey | sudo tee /etc/wireguard/server_public.key
# View keys
sudo cat /etc/wireguard/server_private.key
sudo cat /etc/wireguard/server_public.key
# Set file permissions
sudo chmod 600 /etc/wireguard/server_private.key
# Find your network interface
ip route | grep default
# Example output: default via 192.168.1.1 dev eth0
# Here 'eth0' is the network interface
# Create WireGuard configuration file
sudo nano /etc/wireguard/wg0.conf
# /etc/wireguard/wg0.conf — Server configuration
[Interface]
# IP address of the WireGuard interface
Address = 10.0.0.1/24
# WireGuard listening port
ListenPort = 51820
# Server private key
PrivateKey = SERVER_PRIVATE_KEY_HERE
# IP forwarding rules (PostUp/PostDown)
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
# Client 1 (Peer)
[Peer]
# Client public key
PublicKey = CLIENT1_PUBLIC_KEY
# IP assigned to client
AllowedIPs = 10.0.0.2/32
# Client 2 (Peer)
[Peer]
PublicKey = CLIENT2_PUBLIC_KEY
AllowedIPs = 10.0.0.3/32
Replace eth0 with your actual network interface name. Find it with ip route | grep default.
# Enable temporarily
sudo sysctl -w net.ipv4.ip_forward=1
# Enable permanently
sudo nano /etc/sysctl.conf
# Add or uncomment this line:
# net.ipv4.ip_forward=1
# Apply changes
sudo sysctl -p
# Verify
cat /proc/sys/net/ipv4/ip_forward
# Output: 1
# If using UFW
sudo ufw allow 51820/udp
sudo ufw allow OpenSSH
sudo ufw enable
# For UFW forwarding
sudo nano /etc/default/ufw
# Change DEFAULT_FORWARD_POLICY="ACCEPT"
sudo nano /etc/ufw/before.rules
# Add before the *filter line:
# NAT table
*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE
COMMIT
# If using iptables
sudo iptables -A INPUT -p udp --dport 51820 -j ACCEPT
sudo iptables -A FORWARD -i wg0 -j ACCEPT
sudo iptables -A FORWARD -o wg0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# Make rules persistent
sudo apt install iptables-persistent -y
sudo netfilter-persistent save
# Start WireGuard interface
sudo wg-quick up wg0
# Auto-start on boot
sudo systemctl enable wg-quick@wg0
# Check status
sudo wg show
# View interface info
ip addr show wg0
# On the client side (or generate on server and transfer)
wg genkey | tee client_private.key | wg pubkey > client_public.key
cat client_private.key # Private key
cat client_public.key # Public key (to be added to server)
# /etc/wireguard/wg0.conf — Client configuration
[Interface]
# Client's VPN IP address
Address = 10.0.0.2/24
# Client private key
PrivateKey = CLIENT_PRIVATE_KEY
# DNS (optional)
DNS = 1.1.1.1
[Peer]
# Server public key
PublicKey = SERVER_PUBLIC_KEY
# Server address and port
Endpoint = SERVER_IP:51820
# Which traffic to route through VPN
# For all traffic:
AllowedIPs = 0.0.0.0/0, ::/0
# For VPN network only:
# AllowedIPs = 10.0.0.0/24
# Keep connection alive (for clients behind NAT)
PersistentKeepalive = 25
# Connect on Linux client
sudo wg-quick up wg0
# Test connection
ping 10.0.0.1
curl ifconfig.me # Verify external IP is server's IP
[Interface]
Address = 10.0.0.3/24
PrivateKey = WINDOWS_CLIENT_PRIVATE_KEY
DNS = 1.1.1.1
[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = SERVER_IP:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25
# Generate QR code on server
sudo apt install qrencode -y
qrencode -t ansiutf8 < /path/to/client.conf
# 1. Generate client keys
wg genkey | tee /etc/wireguard/client3_private.key | wg pubkey > /etc/wireguard/client3_public.key
# 2. Add to server config (without restarting service)
sudo wg set wg0 peer $(cat /etc/wireguard/client3_public.key) allowed-ips 10.0.0.4/32
# 3. Save permanently
sudo wg-quick save wg0
# 4. Check status
sudo wg show
# View WireGuard logs
sudo journalctl -u wg-quick@wg0 -f
# Connection statistics
sudo wg show wg0
# Packet capture (for troubleshooting)
sudo tcpdump -i wg0
# Check IP forwarding
cat /proc/sys/net/ipv4/ip_forward
# Check firewall rules
sudo iptables -L -n -v
sudo iptables -t nat -L -n -v
After establishing a WireGuard connection, the latest handshake field in sudo wg show output should be current. If there's no handshake, check the server IP/port, keys, and firewall rules in the client configuration.
WireGuard provides a modern and secure VPN solution. With its simple configuration and high performance, it's ideal for both personal use and enterprise networks. Setting up WireGuard on your REXE server ensures all your clients can establish secure connections.
WireGuard uses UDP port 51820 by default. You can change this — replace the ListenPort value in the configuration file with your desired port number. Don't forget to open the same port in your firewall.
WireGuard is much simpler (4000 lines of code), faster, and uses modern cryptography. OpenVPN is more mature with broader platform support. WireGuard is recommended for new setups. If you have existing OpenVPN infrastructure, plan the migration carefully.
Use AllowedIPs = 0.0.0.0/0, ::/0 in the client configuration. This routes all IPv4 and IPv6 traffic through the VPN tunnel. IP forwarding and NAT masquerade must be enabled on the server.
WireGuard has no theoretical client limit. The practical limit depends on server hardware. Add a separate [Peer] block for each client and assign a unique IP address.
Check connection status with 'sudo wg show'. If the 'latest handshake' field is not current, there's no connection. Check server IP/port, keys, and firewall rules. Restart with 'sudo wg-quick down wg0 && sudo wg-quick up wg0'.
Protect your Linux server against malware and rootkits. rkhunter and ClamAV installation, scan configuration, result interpretation, scheduled scans, and incident response guide.
Protect your server against SSH brute-force attacks with Fail2Ban. Installation, jail.local configuration, Nginx/Apache jails, IP whitelisting, ban monitoring, and email alerts.
Zero Trust network security principles and practical implementation: never trust always verify, micro-segmentation, identity-based access, and implementation with existing Linux tools.