Self-Hosted WireGuard VPN: Secure Remote Access Guide

Your self-hosted applications are protected behind a reverse proxy, but some services should not be exposed to the internet at all. Database administration, server monitoring, and internal tools should only be accessible through a VPN. WireGuard gives you this access with minimal overhead.

Step 1: Install WireGuard

sudo apt update
sudo apt install wireguard -y

Step 2: Generate Keys

Generate the server's private and public keys:

wg genkey | sudo tee /etc/wireguard/server_private.key
sudo chmod 600 /etc/wireguard/server_private.key
sudo cat /etc/wireguard/server_private.key | wg pubkey | sudo tee /etc/wireguard/server_public.key

Generate keys for each client device (laptop, phone, tablet):

wg genkey | tee client1_private.key
cat client1_private.key | wg pubkey | tee client1_public.key

Step 3: Configure the Server

Create /etc/wireguard/wg0.conf:

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = YOUR_SERVER_PRIVATE_KEY
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# Laptop
PublicKey = CLIENT1_PUBLIC_KEY
AllowedIPs = 10.0.0.2/32

[Peer]
# Phone
PublicKey = CLIENT2_PUBLIC_KEY
AllowedIPs = 10.0.0.3/32

Enable IP forwarding:

sudo sysctl -w net.ipv4.ip_forward=1
echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.conf

Step 4: Start WireGuard

sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

Open port 51820 on your firewall:

sudo ufw allow 51820/udp

Step 5: Configure Client Devices

Create a client configuration file for each device:

[Interface]
PrivateKey = CLIENT1_PRIVATE_KEY
Address = 10.0.0.2/24
DNS = 10.0.0.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = your-server-ip:51820
AllowedIPs = 10.0.0.0/24
PersistentKeepalive = 25

Import this configuration into the WireGuard app on your laptop, phone, or tablet. Activate the tunnel. You can now access all internal services using their private IP addresses: SSH at 10.0.0.1:22, Portainer at http://10.0.0.1:9000, and database administration tools at their private ports.

Docker Alternative: wg-easy

If managing WireGuard configuration files manually is too much, wg-easy provides a web interface for WireGuard management:

services:
  wg-easy:
    image: ghcr.io/wg-easy/wg-easy:latest
    container_name: wg-easy
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv4.ip_forward=1
    volumes:
      - ./data:/etc/wireguard
    ports:
      - "51820:51820/udp"
      - "51821:51821/tcp"
    environment:
      - WG_HOST=your-server-ip
      - PASSWORD=your_admin_password
      - WG_DEFAULT_DNS=1.1.1.1

Open https://your-server-ip:51821. Log in with your admin password. Create client configurations with a few clicks. Download the QR code or configuration file for each device. wg-easy handles the key generation and configuration automatically.

If configuring VPN tunnels and iptables rules is not your idea of a productive afternoon, VPS1 deploys WireGuard with client configurations for all your devices. You get secure access to your internal services. We handle the networking.