WireGuard VPN Linux: Configure in 15 Minutes 2026

WireGuard is a modern VPN protocol that lets you configure a secure connection on Linux in minutes. To configure a WireGuard VPN on Linux, install the package, generate the cryptographic keys, define the configuration file on server and client, and start the tunnel with systemctl. In 15 minutes you get a stable, fast, and encrypted connection.

| Aspect | WireGuard | OpenVPN |

|—|—|—|

| Lines of code | 4,000 | 100,000 |

| Handshake | < 100ms | > 1,000ms |

| Config file | ~10 lines | ~200 lines |

| Cryptography | Curve25519, ChaCha20 | AES, RSA |

OpenVPN on a VPS. 80ms latency. 200-line configuration. A client disconnecting every 30 minutes. WireGuard in production for 15 minutes resolved all three. When I migrated the remote connectivity of a public healthcare organization from OpenVPN to WireGuard, tickets for unstable VPN dropped to zero. 73% of breaches start from stolen credentials according to the Verizon DBIR 2025, and having a reliable VPN tunnel reduces the risk that users disable protection out of frustration. WireGuard has been in the Linux kernel since version 5.6 and handles roaming natively. If you change networks, the tunnel stays up.

Prerequisites / Test Environment

You need a Linux server (VPS or local machine) with kernel 5.6 or higher and root permissions. For this guide I used Ubuntu 22.04 LTS as the server and a Linux client. You will also need a mobile client to test the QR code.

Install WireGuard VPN Linux Server and Client

Installation requires a single package. On Debian and derivatives:

sudo apt install wireguard

On RHEL, CentOS or Fedora:

sudo dnf install wireguard-tools

The kernel module is already included in modern distributions. If you use a very old custom kernel, verify its presence with modprobe wireguard. WireGuard runs on about 4,000 lines of code, compared to OpenVPN’s 100,000, reducing the attack surface drastically.

Generate Cryptographic Keys

WireGuard does not use X.509 certificates. It uses only cryptographic key pairs. Generate the keys for the server:

wg genkey | tee privatekey | wg pubkey > publickey

Protect the private key:

chmod 600 privatekey

Repeat the same process on the Linux client. You will have two key pairs, one for the server and one for the client. The private key never leaves the machine that generates it. The public key goes to the counterpart.

Configure the WireGuard Server

Create the /etc/wireguard/wg0.conf file on the server. Insert the server private key and the client public key.

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <SERVER_PRIVATE_KEY>

# Enable NAT for clients
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = <CLIENT_PUBLIC_KEY>
AllowedIPs = 10.0.0.2/32

Replace eth0 with the primary network interface of your server (verify with ip a). Enable IP forwarding on the server, otherwise traffic will not be forwarded:

echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.d/99-wireguard.conf
sudo sysctl -p /etc/sysctl.d/99-wireguard.conf

Configure the Linux Client

On the client, create the /etc/wireguard/wg0.conf file:

[Interface]
Address = 10.0.0.2/24
PrivateKey = <CLIENT_PRIVATE_KEY>
DNS = 1.1.1.1

[Peer]
PublicKey = <SERVER_PUBLIC_KEY>
Endpoint = <SERVER_PUBLIC_IP>:51820
AllowedIPs = 10.0.0.0/24

The public IP address of the server must be reachable from the client. The AllowedIPs directive defines which destinations pass through the tunnel. With 10.0.0.0/24 only internal VPN addresses pass.

Read also: SSH Hardening Linux: Complete Guide 2026 (10 Critical Settings)

Configure Mobile Client via QR Code

For Android or iOS devices, generate a QR code from the client configuration. Install the tool:

sudo apt install qrencode

Create a text file with the client configuration (the same as above) and generate the QR code:

qrencode -t ansiutf8 < client_mobile.conf

Scan the code with the official WireGuard app on your smartphone. The tunnel configures in 5 seconds without typing anything.

Start and Test the Tunnel

Start the tunnel on the server:

sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

Do the same on the Linux client. Verify the tunnel status:

sudo wg show

Check that the handshake occurred. If you see a timestamp under Latest handshake, the tunnel is active. Test connectivity:

ping 10.0.0.1

If you get a reply, your WireGuard VPN on Linux is operational. Traffic to the 10.0.0.0/24 subnet passes encrypted.

Route All Traffic via VPN (Full Tunnel)

To route all client browsing traffic through the VPN, modify the AllowedIPs directive in the client configuration file:

AllowedIPs = 0.0.0.0/0

This routes every connection through the server. Make sure the server has NAT configured correctly (as seen in the server PostUp section) and that the firewall allows outbound traffic. Set a valid DNS in the client [Interface] section, like DNS = 1.1.1.1, to prevent DNS resolution leaks.

Add Multiple Clients

Each client needs a unique key pair and a dedicated IP address. Generate keys on the new client, then add a [Peer] block on the server:

[Peer]
PublicKey = <CLIENT_2_PUBLIC_KEY>
AllowedIPs = 10.0.0.3/32

On the new client, configure Address = 10.0.0.3/24. Restart the interface on the server to apply changes. To avoid dropping active connections, reload the configuration hot:

sudo wg syncconf wg0 <(wg-quick strip wg0)

Common Errors and Troubleshooting

If the tunnel fails to establish, check these points.

1. No handshake: Verify that the public IP and port of the server are correct on the client. Check that the server firewall allows UDP traffic on port 51820.
2. Handshake present but no connectivity: Ensure IP forwarding is active on the server (sysctl net.ipv4.ip_forward). Check iptables rules for NAT.
3. Wrong MTU: If ping works but browsing fails, reduce the MTU. Add MTU = 1360 in the client [Interface] section.
4. Client disconnected after network change: WireGuard handles roaming natively. If the problem persists, verify the client sends data to keep the state alive on the server stateful firewall.

To monitor traffic in real time and verify where it blocks:

sudo tcpdump -i wg0

Consult the official documentation to explore advanced parameters: WireGuard Official Documentation.

Conclusions with Operational Takeaways

WireGuard solves the complexity problem of legacy VPNs. Configuration requires 10 lines versus 200 for OpenVPN. The handshake happens in under 100ms and roaming between networks does not drop the tunnel.

Three operational takeaways:

1. Use 256-bit keys and disable password-based SSH access to protect the VPN server.
2. Enable full tunnel (AllowedIPs = 0.0.0.0/0) for mobile clients to prevent traffic leaks on unsecured networks.
3. Manage additional clients with static IP addresses and reload configuration hot with wg syncconf.

Configure WireGuard on your VPS today. In 15 minutes you will have a stable, fast personal VPN.