Skip to main content
WireGuard is a fast VPN protocol, and the tunnel does not drop when your network changes. A script sets it up on the VPS in a couple of minutes.

​
Installation

The script installs WireGuard, sets up NAT and the service, and creates the first client.
  1. SSH – connect as root, the IP and password are on the server card: Connection.
  2. Script – angristan/wireguard-install, download and run it:
  3. Questions – public IP, port, DNS for clients, and the first client’s name. If unsure, press Enter: the defaults work for almost everyone. Remember the port: you will open it in the firewall.
  4. Client config – at the end the script shows a QR code and creates a .conf file. Scan the QR from your phone, move the file to your computer.

​
Manual installation

Instead of the script, if you want full control. Commands for Ubuntu and Debian.
Besides these steps you need NAT rules (iptables / MASQUERADE), otherwise client traffic will not reach the internet. The script sets them up itself.
  1. Package:
  2. Keys – privatekey is the server’s secret key, publickey the public one:
  3. Server config – file /etc/wireguard/wg0.conf, a minimal example:
  4. Routing – without it the server will not pass client traffic:
  5. Start – bring up the interface:
    • Stop – wg-quick down wg0.
    • Start on boot – systemctl enable wg-quick@wg0.

​
Port

Open WireGuard’s UDP port in the firewall, otherwise clients will not connect. If you used the script, replace 51820 with the port you chose:
More: Firewall.

​
Clients

Install the official WireGuard app:
  • Windows – installer from wireguard.com/install.
  • macOS, iOS – App Store.
  • Android – Google Play or the APK from the site.
  • Linux – your distribution’s package manager.
In the app: Add Tunnel → import the .conf file or scan the QR code. Turn on the tunnel and all traffic goes through the server. Each device needs its own config: run ./wireguard-install.sh again and add a client. The same menu removes a client or WireGuard entirely.

​
Troubleshooting

  • Client does not connect – check that the UDP port from the installation is open in the firewall.
  • Port will not open or the server has no network – write to @lumisup_robot. Support handles the server and network, the VPN is on you.
Next: Server hardening, Amnezia.