How to Set Up WireGuard VPN on Ubuntu 20.04: Step-by-Step Guide

Introduction

WireGuard is a modern, high-performance VPN protocol that aims to be faster, simpler, and more secure than legacy solutions like OpenVPN or IPsec. Built into the Linux kernel since version 5.6, WireGuard offers minimal attack surface, strong cryptography (Curve25519, ChaCha20, Poly1305), and seamless roaming. This guide walks you through setting up a WireGuard VPN server on Ubuntu 20.04 and configuring a client to connect securely.

Prerequisites

Before starting, ensure you have:

• An Ubuntu 20.04 server with a public IP address and root or sudo access.
• A client machine (Linux, Windows, macOS, or mobile) with WireGuard installed.
• Basic familiarity with the command line and networking concepts.

Step 1: Install WireGuard on the Server

WireGuard is available in Ubuntu’s default repositories. Update your package list and install it:

sudo apt update
sudo apt install wireguard

This installs both the kernel module and userspace tools (wg and wg-quick).

Step 2: Generate Server Key Pair

WireGuard uses public-key cryptography. Generate a private key and derive its public key:

wg genkey | sudo tee /etc/wireguard/server_private.key
sudo chmod 600 /etc/wireguard/server_private.key
sudo cat /etc/wireguard/server_private.key | wg pubkey | sudo tee /etc/wireguard/server_public.key

Keep the private key secret; the public key will be shared with clients.

Step 3: Configure the WireGuard Server

Create the configuration file /etc/wireguard/wg0.conf:

sudo nano /etc/wireguard/wg0.conf

Add the following content, replacing ServerPrivateKey with the contents of server_private.key and ServerPublicIP with your server’s public IP:

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <ServerPrivateKey>

# Enable IP forwarding (required for routing)
PostUp = sysctl -w net.ipv4.ip_forward=1
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Here, 10.0.0.1/24 is the VPN subnet; adjust if needed. Replace eth0 with your server’s external interface (check with ip route).

Step 4: Configure Firewall and Enable IP Forwarding

Allow WireGuard UDP traffic on port 51820:

sudo ufw allow 51820/udp

Enable IP forwarding permanently by editing /etc/sysctl.conf:

sudo nano /etc/sysctl.conf
# Uncomment or add:
net.ipv4.ip_forward=1

Apply changes:

sudo sysctl -p

Step 5: Start and Enable WireGuard

Start the WireGuard interface and enable it on boot:

sudo systemctl start wg-quick@wg0
sudo systemctl enable wg-quick@wg0

Check the interface status:

sudo wg show

You should see the interface with no peers yet.

Step 6: Configure a Client (Linux Example)

On the client machine, install WireGuard and generate a key pair:

sudo apt update
sudo apt install wireguard
wg genkey | sudo tee /etc/wireguard/client_private.key
sudo chmod 600 /etc/wireguard/client_private.key
sudo cat /etc/wireguard/client_private.key | wg pubkey | sudo tee /etc/wireguard/client_public.key

Create the client configuration /etc/wireguard/wg0.conf:

[Interface]
PrivateKey = <ClientPrivateKey>
Address = 10.0.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = <ServerPublicKey>
Endpoint = <ServerPublicIP>:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

AllowedIPs = 0.0.0.0/0 routes all traffic through the VPN (full tunnel). For split tunneling, specify only the VPN subnet (e.g., 10.0.0.0/24).

Start the client:

sudo systemctl start wg-quick@wg0
sudo systemctl enable wg-quick@wg0

Step 7: Add the Client to the Server

On the server, add the client’s public key to /etc/wireguard/wg0.conf under the [Peer] section:

[Peer]
PublicKey = <ClientPublicKey>
AllowedIPs = 10.0.0.2/32

Restart WireGuard to apply changes:

sudo systemctl restart wg-quick@wg0

Verify the connection on both sides with sudo wg show. You should see handshake and transfer counters.

Testing and Troubleshooting

Ping the server’s VPN IP from the client:

ping 10.0.0.1

Check internet connectivity through the VPN:

curl ifconfig.me

If issues arise, verify firewall rules, IP forwarding, and that both peers have correct public keys and endpoints. Use journalctl -u wg-quick@wg0 for logs.

Conclusion

You now have a functional WireGuard VPN on Ubuntu 20.04. WireGuard’s simplicity and performance make it ideal for secure remote access, site-to-site connections, or bypassing geo-restrictions. For production use, consider adding more clients, automating key management, or integrating with tools like Ansible. The official WireGuard documentation provides further details on advanced configurations.