Install WireGuard VPN on Ubuntu 24.04 – Secure and Fast VPN Setup Guide

WireGuard is an open-source virtual private network (VPN) that applies advanced modern cryptography to safeguard communication between servers and clients. It is lightweight, efficient, and has a minimal codebase focusing on essential features, providing superior performance and security compared to other VPNs such as OpenVPN.

This guide details how to install and configure WireGuard VPN on Ubuntu 24.04 to create secure, encrypted network tunnels.

Prerequisites

• Deploy an Ubuntu 24.04 server to use as the WireGuard VPN host.
• Access the server through SSH as a non-root user with sudo privileges.
• Update the server packages to ensure it’s current.

Install WireGuard

WireGuard is included in Ubuntu 24.04’s default APT repositories. Follow the steps below to install the latest version and configure it to launch at system startup.

Install WireGuard

$ sudo apt install wireguard -y

Check Installed Version

$ sudo wg --version

Your output should resemble:

wireguard-tools v1.0.20210914 - https://git.zx2c4.com/wireguard-tools/

Configure WireGuard

WireGuard uses Cryptokey Routing to establish VPN tunnels through validation of public keys tied to specific IPs. A valid setup includes both a private and public key linked to the network interface. Follow these steps to configure your WireGuard interface and create the necessary key pairs.

Generate the Private Key

$ sudo wg genkey | sudo tee /etc/wireguard/server_private.key

Example output:

UOO//MO2GCC+5hHOz91YCP60/Zv/cnSskEH2j4eRPXo=

Adjust File Permissions

$ sudo chmod 600 /etc/wireguard/server_private.key

Generate the Public Key

$ sudo cat /etc/wireguard/server_private.key | wg pubkey | sudo tee /etc/wireguard/server_public.key

Example output:

W+l7Uapd98bsNhN1g3Hs4iTCfKzcV03KNwhDPFgzqR4=

Check Network Interfaces

$ ip a

Locate the main network interface, e.g., enp1s0 with IP 192.0.2.161. WireGuard uses this interface to route and translate traffic to the Internet.

Create WireGuard Configuration File

$ sudo nano /etc/wireguard/wg0.conf

Insert the following configuration (replace keys and interface as required):

[Interface]
Address = 10.8.0.1/24
SaveConfig = true
PrivateKey = UOO//MO2GCC+5hHOz91YCP60/Zv/cnSskEH2j4eRPXo=
PostUp = ufw route allow in on wg0 out on enp1s0
PostUp = iptables -t nat -I POSTROUTING -o enp1s0 -j MASQUERADE
PreDown = ufw route delete allow in on wg0 out on enp1s0
PreDown = iptables -t nat -D POSTROUTING -o enp1s0 -j MASQUERADE
ListenPort = 51820

This configuration assigns a private IP (10.8.0.1), enables NAT routing, defines firewall and iptables rules, and sets the WireGuard listening port.

Generate Client Configurations

Each client must have a public key in the WireGuard configuration to establish a connection. The steps below guide you in creating a new client setup.

Create Client Keys

$ sudo wg genkey | sudo tee /etc/wireguard/client1_private.key

$ sudo cat /etc/wireguard/client1_private.key | wg pubkey | sudo tee /etc/wireguard/client1_public.key

Create Client Configuration

$ sudo nano /etc/wireguard/client1.conf

Insert the following content, replacing placeholders accordingly:

[Interface]
PrivateKey = KBUxCUqNEJqN3DBO5xu2kiBQFT8Gv46Kkqu6OIKZu3Q=
Address = 10.8.0.2/24
DNS = 8.8.8.8

[Peer]
PublicKey = W+l7Uapd98bsNhN1g3Hs4iTCfKzcV03KNwhDPFgzqR4=
AllowedIPs = 0.0.0.0/0
Endpoint = 192.0.2.161:51820
PersistentKeepalive = 15

This setup allows a client to connect via IP 10.8.0.2, defining the server key, endpoint, and persistent connection interval.

Add Client to Server Configuration

$ sudo nano /etc/wireguard/wg0.conf

Append the following section:

[Peer]
PublicKey = xZB9I6953ebGqWVLCR7L6yJw7YJi0shJ+Sub9gfUFVU=
AllowedIPs = 10.8.0.2/32

Manage the WireGuard Service

Systemd handles WireGuard processes. The wg-quick utility provides management commands for interfaces.

$ sudo systemctl start wg-quick@wg0.service

$ sudo systemctl enable wg-quick@wg0.service

$ sudo systemctl status wg-quick@wg0.service

Use this command to view the current tunnel status:

$ sudo wg show wg0

Set Up Firewall Rules

UFW is typically active by default. Configure it to allow UDP port 51820 and enable IP forwarding for proper routing.

$ sudo ufw allow 22 && sudo ufw enable
$ sudo ufw allow 51820/udp
$ sudo ufw reload

Enable IP Forwarding

$ echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.conf
$ sudo sysctl -p

Apply NAT Rules

$ sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o enp1s0 -j MASQUERADE
$ sudo iptables-save | sudo tee /etc/iptables/rules.v4

Connect Clients to WireGuard VPN

Use your generated client configuration to connect and test tunnel access using Ping.

$ scp linuxuser@wireguard-server-ip:client1.conf .

Test Connectivity

$ ping -c 4 10.8.0.1

Expected output:

4 packets transmitted, 4 received, 0% packet loss

Conclusion

You have successfully installed and configured WireGuard VPN on an Ubuntu 24.04 server, set up client connections, and established secure tunnels. You can create additional interfaces with separate subnets for different user groups. Refer to the official WireGuard documentation for advanced configuration details.