About Wireguard
WireGuard is a lightweight VPN built into the Linux kernel. It relies on public keys and a configuration file of a few lines. The codebase is small, which makes it easier to audit than older VPN stacks, and a tunnel comes up almost instantly. Developers use it, and so do small teams that want to control their own exit point.
When your VPS is delivered, the wireguard package is installed and a wg0 interface is configured and started by wg-quick@wg0. The server listens on UDP port 51820 and uses the private network 10.8.0.0/24 (the server is 10.8.0.1). IPv4 routing and NAT (masquerade) are enabled, so your clients' traffic leaves through the server's public IP.
A first client is already created, with a pre-shared key in addition to the usual key pair. Its configuration is in /root/wg-client.conf, and a QR code for the mobile app is in /root/wg-client-qr.txt. All you have to do is import it.
What you can do with Wireguard
Preconfigured full tunnel
The generated client uses AllowedIPs = 0.0.0.0/0, so all IPv4 traffic goes through the VPS. The client DNS is set to 1.1.1.1.
Client config and QR code
The file /root/wg-client.conf imports as is into WireGuard clients. The QR code in /root/wg-client-qr.txt can be displayed in the terminal and scanned with the mobile app.
Pre-shared key for each peer
A key generated with wg genpsk is added on top of the public key exchange. It strengthens the connection's protection, and the sensitive files are created with mode 600.
Automatic start at boot
The wg-quick@wg0 service is enabled in systemd. The tunnel comes back on its own after a server reboot.
NAT and forwarding already in place
IPv4 forwarding is enabled in /etc/sysctl.d/99-wireguard.conf. The iptables FORWARD and masquerade rules are applied when wg0 starts and removed when it stops.
Get started with Wireguard
From order to production in a few minutes.
- 1
Order the VPS with WireGuard
Choose a Linux VPS in Paris or Frankfurt (Debian 12, Debian 13, Ubuntu 20.04, 22.04 or 24.04). In the "Applications" tab of the order form, tick WireGuard.
- 2
Connect and fetch the client
Once the server is delivered, open an SSH session with the credentials you received. Check that the tunnel is running, then display the QR code or copy the configuration file to your machine.
Bashssh root@SERVER_IP systemctl status wg-quick@wg0 cat /root/wg-client-qr.txt # from your machine: scp root@SERVER_IP:/root/wg-client.conf . - 3
Import the config and test it
Scan the QR code with the WireGuard mobile app, or import wg-client.conf into the desktop app. On Linux, one command is enough. Then check that a handshake has taken place.
Bashsudo wg-quick up ./wg-client.conf sudo wg show - 4
Secure it for production
Make sure UDP port 51820 is open and restrict any other exposed ports. If you prefer a hostname to an IP, replace the client's Endpoint line with YOUR_DOMAIN:51820 once the DNS record exists. Back up /etc/wireguard off the server.
Bashtar czf wg-backup.tgz /etc/wireguard /root/wg-client.conf
Wireguard use cases
Protect public Wi-Fi
From a hotel, a train or a café, your IPv4 traffic goes through an encrypted tunnel to your VPS before it reaches the internet.
Get a fixed exit IP
Your exit IP becomes the VPS address, so you can allow a single address on a firewall, a database or an admin API.
Link your devices together
Your computer, phone and remote machines join the 10.8.0.0/24 network and can reach each other on their private addresses, with the server as the central point.
Pick Paris or Frankfurt
You choose the exit region by selecting the VPS location at order time, for example to test a service from France or Germany.
Wireguard FAQ
Connect over SSH and read /root/wg-client.conf, or display the QR code with cat /root/wg-client-qr.txt. You can also copy the file to your machine with scp root@SERVER_IP:/root/wg-client.conf .
More about Wireguard
Installed files and services
/etc/wireguard/wg0.conf: server configuration (private key, client1 peer, PostUp and PostDown rules)./root/wg-client.conf: configuration of the first client./root/wg-client-qr.txt: QR code for that configuration, which you can display withcat./etc/sysctl.d/99-wireguard.conf: enablesnet.ipv4.ip_forward./opt/install-wireguard.sh: the installation script run at delivery.
The client gets the address 10.8.0.2/32. The public address in Endpoint is the one detected at install time.
Adding another device
Each device needs its own key pair and its own address (10.8.0.3, 10.8.0.4, and so on). Generate the keys on the server, then add a [Peer] block to wg0.conf.
Bashcd /etc/wireguard umask 077 wg genkey | tee client2.key | wg pubkey > client2.pub wg genpsk > client2.psk
Next, add the contents of client2.pub and client2.psk to /etc/wireguard/wg0.conf with AllowedIPs = 10.8.0.3/32, then reload without dropping existing tunnels:
Bashwg syncconf wg0 <(wg-quick strip wg0)
Write the client file by copying /root/wg-client.conf: change PrivateKey and Address, and keep the server's PublicKey and the Endpoint.
Things to watch
The generated client only routes IPv4 (0.0.0.0/0). If your machine has IPv6, that traffic does not go through the tunnel. Disable IPv6 on the client if that matters to you.
The client DNS is 1.1.1.1. To use another resolver, edit the DNS line in the client file. Treat /root/wg-client.conf like a password, because it contains the client's private key. Once imported, delete any copies you do not need.
For more guides on Linux server administration, see our tutorials or the Linux VPS page.
