Self-Hosted WireGuard VPN: Secure Remote Access Guide
Access your self-hosted applications securely from anywhere. WireGuard is fast, simple, and built into the Linux kernel. Here is the complete setup.
Your self-hosted applications are protected behind a reverse proxy, but some services should not be exposed to the internet at all. Database administration, server monitoring, and internal tools should only be accessible through a VPN. WireGuard gives you this access with minimal overhead.
Step 1: Install WireGuard
sudo apt update
sudo apt install wireguard -yStep 2: Generate Keys
Generate the server's private and public keys:
wg genkey | sudo tee /etc/wireguard/server_private.key
sudo chmod 600 /etc/wireguard/server_private.key
sudo cat /etc/wireguard/server_private.key | wg pubkey | sudo tee /etc/wireguard/server_public.keyGenerate keys for each client device (laptop, phone, tablet):
wg genkey | tee client1_private.key
cat client1_private.key | wg pubkey | tee client1_public.keyStep 3: Configure the Server
Create /etc/wireguard/wg0.conf:
[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = YOUR_SERVER_PRIVATE_KEY
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
[Peer]
# Laptop
PublicKey = CLIENT1_PUBLIC_KEY
AllowedIPs = 10.0.0.2/32
[Peer]
# Phone
PublicKey = CLIENT2_PUBLIC_KEY
AllowedIPs = 10.0.0.3/32Enable IP forwarding:
sudo sysctl -w net.ipv4.ip_forward=1
echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.confStep 4: Start WireGuard
sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0Open port 51820 on your firewall:
sudo ufw allow 51820/udpStep 5: Configure Client Devices
Create a client configuration file for each device:
[Interface]
PrivateKey = CLIENT1_PRIVATE_KEY
Address = 10.0.0.2/24
DNS = 10.0.0.1
[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = your-server-ip:51820
AllowedIPs = 10.0.0.0/24
PersistentKeepalive = 25Import this configuration into the WireGuard app on your laptop, phone, or tablet. Activate the tunnel. You can now access all internal services using their private IP addresses: SSH at 10.0.0.1:22, Portainer at http://10.0.0.1:9000, and database administration tools at their private ports.
Docker Alternative: wg-easy
If managing WireGuard configuration files manually is too much, wg-easy provides a web interface for WireGuard management:
services:
wg-easy:
image: ghcr.io/wg-easy/wg-easy:latest
container_name: wg-easy
restart: unless-stopped
cap_add:
- NET_ADMIN
- SYS_MODULE
sysctls:
- net.ipv4.conf.all.src_valid_mark=1
- net.ipv4.ip_forward=1
volumes:
- ./data:/etc/wireguard
ports:
- "51820:51820/udp"
- "51821:51821/tcp"
environment:
- WG_HOST=your-server-ip
- PASSWORD=your_admin_password
- WG_DEFAULT_DNS=1.1.1.1Open https://your-server-ip:51821. Log in with your admin password. Create client configurations with a few clicks. Download the QR code or configuration file for each device. wg-easy handles the key generation and configuration automatically.
If configuring VPN tunnels and iptables rules is not your idea of a productive afternoon, VPS1 deploys WireGuard with client configurations for all your devices. You get secure access to your internal services. We handle the networking.
More articles
Self-Hosted PIM Solutions Compared
If you sell products anywhere other than one shop, you have a product data problem. You might not call it that yet.
5 Ways to Bypass CGNAT in Brunei
Five technologies let you bypass Brunei residential CGNAT. Here is a detailed comparison of speed, privacy, cost, and complexity for each.
Paperless-ngx: Your Self-Hosted Document Management System
Stop searching through filing cabinets. Paperless-ngx digitises, OCRs, and organises every document your business handles.