How to Set Up a WireGuard VPN Server for Remote Access

Step by step

1. Install WireGuard

   WireGuard is part of the Linux kernel since 5.6; install the tools.

   sudo apt update && sudo apt install -y wireguard
   

2. Create the server keys

   Each side has its own key pair. Keep private keys readable by root only.

   umask 077
   wg genkey | sudo tee /etc/wireguard/server.key | wg pubkey | sudo tee /etc/wireguard/server.pub
   

3. Write the server configuration

   Pick a UDP port and the VPN subnet. Each [Peer] block is one user device.

   # /etc/wireguard/wg0.conf
   [Interface]
   Address = 10.99.0.1/24
   ListenPort = 51820
   PrivateKey = <contents of server.key>
   
   [Peer]
   # alice-laptop
   PublicKey = <alice public key>
   AllowedIPs = 10.99.0.10/32
   

4. Enable routing and firewall rules

   Allow forwarding, then only let VPN users reach the networks they need (here the server VLAN 10.1.20.0/24).

   echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-wg.conf && sudo sysctl --system
   sudo iptables -A FORWARD -i wg0 -d 10.1.20.0/24 -j ACCEPT
   sudo iptables -A FORWARD -i wg0 -j DROP
   

5. Start the tunnel

   Bring up the interface and enable it at boot. Open UDP 51820 on the Internet firewall to this server only.

   sudo systemctl enable --now wg-quick@wg0
   sudo wg show
   

6. Create a client configuration

   Generate keys on the client (or for the user), add its public key as a peer on the server, and give the user this file or a QR code for the mobile app.

   [Interface]
   PrivateKey = <alice private key>
   Address = 10.99.0.10/32
   DNS = 10.1.10.1
   
   [Peer]
   PublicKey = <server public key>
   Endpoint = vpn.example.com:51820
   AllowedIPs = 10.1.0.0/16    # split tunnel: only company networks
   PersistentKeepalive = 25
   

7. Remove users who leave

   Delete the [Peer] block and apply the change without dropping other users.

   sudo wg set wg0 peer <alice public key> remove
   # and delete the block from wg0.conf
   

Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.