Run your own VPN with WireGuard

WireGuard is a VPN protocol built into the Linux kernel that lets you set up your own VPN server with a few commands. Your own VPN sends your traffic out through an IP address you control. It doesn't make you anonymous, though: the sites you visit see your server's IP address.

This article covers what your own VPN is good for and what it doesn't solve, the manual setup steps, and the easier route with a web interface.

What is your own VPN good for?

• Public Wi-Fi: On a cafe or hotel network, your traffic travels encrypted all the way to your server.
• A Turkish IP from abroad: Because the server is in Istanbul, you can come out with a Turkish IP address while you are abroad.
• Private-network access: You reach the devices you connect to the same VPN, and services on the server, as if you were all on the same local network.
• A fixed exit address: Even if your home IP changes, your VPN exit stays the same.

What doesn't it solve?

• It doesn't make you anonymous. Sites see your server's IP address, and that address is tied to your account.
• Some services block data-center IP addresses. Don't assume every service will open through your VPN.
• It doesn't offer exits in many countries. Your server sits in one place, which is Istanbul at Seturack.
• It wasn't designed for giving other people internet access. If you provide internet access to others through your server, the obligations under Law No. 5651 are yours according to the service agreement. Use the VPN mainly for your own devices, and read the service agreement before you give anyone else access.

Why people like WireGuard

• It entered the Linux kernel with version 5.6, so on current distributions you don't need to install a separate driver.
• There are no passwords. Each end is recognized by its own private and public key pair.
• The configuration is short and fits in one file.
• It uses UDP. The port you see most often in examples and tools is 51820.

Manual setup (Ubuntu, as root)

1. Install the package: apt install wireguard
2. Generate the server key pair: umask 077 && wg genkey | tee privatekey | wg pubkey > publickey
3. Let each client device generate its own key. The WireGuard app on phones and computers does this, and you only need its public key.
4. Write /etc/wireguard/wg0.conf following the table below.
5. Turn on IP forwarding: echo 'net.ipv4.ip_forward=1' | tee /etc/sysctl.d/70-wireguard.conf and then sysctl --system
6. Open the port in the firewall: ufw allow 51820/udp
7. Start it: systemctl enable --now wg-quick@wg0

Write the [Interface] lines to the file first, then the [Peer] lines. Each client gets its own [Peer] block.

Connecting a client

On the client, put your own private key, the line Address = 10.8.0.2/24 and a DNS address in the [Interface] section. In the [Peer] section, put the server's public key, the line Endpoint = SERVER_IP:51820 and the line AllowedIPs = 0.0.0.0/0. The last value sends all IPv4 traffic through the tunnel. If you only want to reach the VPN network, write 10.8.0.0/24 instead. For devices behind NAT or a firewall, the official documentation suggests PersistentKeepalive = 25.

Run wg show on the server. If the client has connected, you see a "latest handshake" line.

All traffic or only some of it?

The AllowedIPs value on the client decides which traffic enters the tunnel. 0.0.0.0/0 sends all IPv4 traffic through it, but not IPv6. If your device has IPv6, that traffic can bypass the tunnel. With 0.0.0.0/0, ::/0, IPv6 enters the tunnel too and is dropped there, because the server carries no IPv6, so it can't leak. If you only want to reach certain networks, for example 10.8.0.0/24, write just those. This is called split tunneling, and the rest of the traffic leaves by its normal route. For reaching a network remotely, split tunneling is often enough. The rest of your traffic doesn't pass through the tunnel, so it isn't slowed down.

The easier way: wg-easy

wg-easy is a tool that bundles the WireGuard server and client management with a web interface. It adds and removes clients and shows a QR code for phones. It installs with Docker Compose and uses 51820/UDP. A reverse proxy is recommended if you want to open the admin screen to the internet securely.

Seturack's ready-made WireGuard server uses wg-easy and is up in about 4 minutes. In the panel you see the admin address and the password. The tunnel carries IPv4 only. Create a separate client for each device, and if you lose a device you delete only its client. The connection steps are in the WireGuard help article.

Setting up your devices

WireGuard has official apps for Windows, macOS, Android and iOS. On Linux the package is enough. On a phone you add the configuration with a QR code, and on a computer by importing the configuration file. You switch the tunnel on and off from the app. While the tunnel is up, your internet traffic leaves through your server.

Four small security rules

• Let only root read the configuration file: chmod 600 /etc/wireguard/wg0.conf
• Never send your private key to anyone. The public key is the only thing you share.
• Delete the [Peer] block of a device you lost or no longer want to allow.
• Keep the server up to date. Operating system and application updates are yours after setup.

Because your VPN traffic passes through the server, traffic volume matters as well. Unlimited traffic is included in the Seturack price.

If it won't connect

Some networks block UDP traffic. Try another network, for example your phone's mobile data. Also check that port 51820/UDP is open in the firewall.

If you'd like to start with the ready-made install, see the WireGuard VPN page.