A VPN on your own VPS encrypts your traffic on untrusted networks (hotels, airports, public Wi-Fi), gives you a fixed IP address for allow-listing admin panels, and lets you reach private services on your server. WireGuard is the best choice for this today: fast, simple, built into the Linux kernel, with apps for every platform.

This guide sets up a server on Ubuntu 22.04/24.04 or Debian 12/13 and connects two devices.

1. Install WireGuard

apt update
apt install -y wireguard qrencode

2. Generate keys

cd /etc/wireguard
umask 077
wg genkey | tee server.key | wg pubkey > server.pub
wg genkey | tee laptop.key | wg pubkey > laptop.pub
wg genkey | tee phone.key  | wg pubkey > phone.pub

3. Find your public interface

ip route get 1.1.1.1 | awk '{print $5; exit}'    # e.g. ens3 or eth0

4. Server configuration

Create /etc/wireguard/wg0.conf (replace ens3 with your interface and paste the keys):

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <contents of server.key>
PostUp   = iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ens3 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o ens3 -j MASQUERADE

[Peer]
# laptop
PublicKey = <contents of laptop.pub>
AllowedIPs = 10.8.0.2/32

[Peer]
# phone
PublicKey = <contents of phone.pub>
AllowedIPs = 10.8.0.3/32

5. Enable IP forwarding

echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-wireguard.conf
sysctl --system

6. Open the firewall and start

ufw allow 51820/udp
ufw route allow in on wg0 out on ens3     # if ufw is active
systemctl enable --now wg-quick@wg0
wg show

7. Client configuration

For the laptop, create laptop.conf:

[Interface]
PrivateKey = <contents of laptop.key>
Address = 10.8.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = <contents of server.pub>
Endpoint = YOUR_SERVER_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

AllowedIPs = 0.0.0.0/0 sends all traffic through the VPN. To only reach the server’s private services, use AllowedIPs = 10.8.0.0/24 instead (a “split tunnel”).

Import it in the WireGuard app (Windows, macOS, Linux). For the phone, create phone.conf the same way (address 10.8.0.3/32) and show it as a QR code:

qrencode -t ansiutf8 < phone.conf

Scan it in the WireGuard app on iOS or Android.

8. Test

Connect, then check your public IP (for example by searching “what is my IP”) — it should show the VPS’s address. On the server, wg show lists each peer’s latest handshake and transfer counters.

Adding more devices

Generate another key pair, add a [Peer] with the next free address, and apply without dropping existing connections:

wg syncconf wg0 <(wg-quick strip wg0)

For many users, a web UI such as wg-easy (a Docker container) makes peer management easier.

Choosing a location

Your traffic exits from the VPS, so pick a location that suits you: a USA VPS for North American services, Hong Kong or Tokyo for Asia. Each location page lists test IPs you can ping first.

Acceptable use

A personal VPN is for protecting your own traffic. Running open proxies or VPN services that are used for abuse violates most providers’ terms — including ours. Keep your peers to devices you control.

  • VPN
  • WireGuard
  • Security