Set up your own VPN with WireGuard

WireGuard is a fast, modern VPN. Running it on your VPS gives you a private, encrypted connection for your own devices. It's useful on public Wi-Fi, for reaching private services on your server, or for giving your team a fixed IP address to whitelist.

This guide uses wg-easy, which runs WireGuard in Docker and adds a simple web interface for creating VPN users, with QR codes for phones. It works on every operating system we offer: Ubuntu 22.04, 24.04 and 26.04, Debian 12 and 13, AlmaLinux 8, 9 and 10, and Rocky Linux 9 and 10.

Please note: a VPN on your VPS is for your own devices, or your organisation's. Running a public or commercial VPN or proxy service isn't permitted under our Acceptable Use Policy.

Before you start

• Any VPS size will do. WireGuard is very lightweight.
• SSH access as root or as a user with sudo rights. If you're logged in as root, you can leave sudo off the commands.
• Check that the WireGuard kernel module is available, by running sudo modprobe wireguard && echo OK. If it doesn't print OK, update the server (sudo apt upgrade or sudo dnf upgrade), reboot and try again.

Step 1: Install Docker

Skip this step if Docker is already installed (docker --version shows a version).

Ubuntu 22.04, 24.04, 26.04 and Debian 12, 13

sudo apt update
sudo apt install -y ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
. /etc/os-release
sudo curl -fsSL https://download.docker.com/linux/$ID/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/$ID
Suites: ${UBUNTU_CODENAME:-$VERSION_CODENAME}
Components: stable
Signed-By: /etc/apt/keyrings/docker.asc
EOF
sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

AlmaLinux 8, 9, 10 and Rocky Linux 9, 10 (this removes Podman, which conflicts with Docker):

sudo dnf remove -y podman runc
sudo dnf install -y dnf-plugins-core
sudo dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
sudo dnf install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

All systems: start Docker and check it works.

sudo systemctl enable --now docker
sudo docker run --rm hello-world

Step 2: Create the wg-easy configuration

sudo mkdir -p /etc/docker/containers/wg-easy
cd /etc/docker/containers/wg-easy
sudo nano docker-compose.yml

Paste in the following. It's the standard wg-easy configuration, with the web interface limited to the server itself (127.0.0.1) so it can't be reached from the internet. You'll open it securely through SSH in Step 4.

volumes:
  etc_wireguard:

services:
  wg-easy:
    image: ghcr.io/wg-easy/wg-easy:15
    container_name: wg-easy
    environment:
      - INSECURE=true
    networks:
      wg:
        ipv4_address: 10.42.42.42
        ipv6_address: fdcc:ad94:bacf:61a3::2a
    volumes:
      - etc_wireguard:/etc/wireguard
      - /lib/modules:/lib/modules:ro
    ports:
      - "51820:51820/udp"
      - "127.0.0.1:51821:51821/tcp"
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv6.conf.all.forwarding=1
      - net.ipv6.conf.default.forwarding=1

networks:
  wg:
    driver: bridge
    enable_ipv6: true
    ipam:
      driver: default
      config:
        - subnet: 10.42.42.0/24
        - subnet: fdcc:ad94:bacf:61a3::/64

Press Ctrl+O and Enter to save, then Ctrl+X to exit.

Step 3: Open the firewall and start wg-easy

WireGuard needs UDP port 51820.

Ubuntu/Debian with UFW enabled:

sudo ufw allow 51820/udp

AlmaLinux/Rocky with firewalld:

sudo firewall-cmd --permanent --add-port=51820/udp
sudo firewall-cmd --reload

Start wg-easy:

cd /etc/docker/containers/wg-easy
sudo docker compose up -d

Step 4: Open the web interface through SSH

On your own computer (not the server), open a terminal and run the command below, replacing YOUR_SERVER_IP with your VPS IP address. On Windows, use Windows Terminal or PowerShell.

ssh -L 51821:127.0.0.1:51821 root@YOUR_SERVER_IP

Leave that window open, then browse to http://localhost:51821 on the same computer. The SSH connection carries the web interface securely to your computer.

The setup wizard asks you to:

1. Create an admin username and a strong password.
2. Enter the host your devices will connect to. Use your VPS IP address, or a domain that points to it.
3. Confirm the port, 51820.

Step 5: Add your devices

1. In wg-easy, click New and give the device a name, such as "John's phone". Create a separate client for each device.
2. Install the WireGuard app from wireguard.com/install. It's available for Windows, macOS, Linux, iOS and Android.
3. Phone: in the WireGuard app, tap +, choose to scan a QR code, and scan the QR code shown in wg-easy.
   Computer: download the configuration file from wg-easy and import it into the WireGuard app.
4. Turn the connection on. To check it's working, search "what is my IP" in your browser. It should show your VPS IP address.

Keeping it up to date

cd /etc/docker/containers/wg-easy
sudo docker compose pull
sudo docker compose up -d

Keep the server's operating system updated as well, with sudo apt update && sudo apt upgrade or sudo dnf upgrade.

Troubleshooting

• The app says it's connected, but there's no handshake or data: UDP port 51820 isn't reachable. Check your firewall, and check that the host you entered in the wizard is your VPS's public IP or a domain that points to it.
• Connected, but websites won't load: run sudo docker logs wg-easy and look for errors. Also check that the WireGuard kernel module loads (see "Before you start").
• http://localhost:51821 won't open: make sure the SSH window from Step 4 is still connected, and that wg-easy is running (sudo docker ps).

Need help?

Our Cloud VPS plans are self-managed, so you're responsible for installing, securing and maintaining the software on your server. If something on our side isn't working, such as the network, or your VPS won't boot, open a support ticket. New to your VPS? Start with our Cloud VPS Getting Started Guide.