Step 1: Update Your System

Before installing WireGuard, ensure your system is up to date. Run the following commands:

sudo apt update && sudo apt upgrade -y

Keeping your system updated is crucial for security and performance, whether you're setting it up locally or on a VPS Windows Servers platform.

Step 2: Install WireGuard

To install WireGuard, run the following command:

sudo apt install wireguard -y

This command will download and install WireGuard and its dependencies.

Step 3: Generate Key Pair

WireGuard uses public and private keys for authentication. Generate your key pair with the following commands:

wg genkey | tee privatekey | wg pubkey > publickey
            

This will create two files, privatekey and publickey, in your current directory. Keep your private key secure.

Step 4: Configure WireGuard

Create a new configuration file for WireGuard:

sudo nano /etc/wireguard/wg0.conf

Add the following configuration, replacing YOUR_PRIVATE_KEY with your actual private key, and YOUR_SERVER_IP with your server's public IP address:

[Interface]
PrivateKey = YOUR_PRIVATE_KEY
Address = 10.0.0.1/24
ListenPort = 51820

[Peer]
PublicKey = YOUR_PEER_PUBLIC_KEY
AllowedIPs = 10.0.0.2/32
            

This configuration sets up the server's interface. You'll need to add client configurations separately.

Step 5: Enable IP Forwarding

To allow packets to be forwarded between network interfaces, enable IP forwarding. Edit the sysctl configuration:

sudo nano /etc/sysctl.conf

Uncomment or add the following line:

net.ipv4.ip_forward=1

Save and exit the file, then apply the changes:

sudo sysctl -p

Step 6: Start WireGuard

You can now start the WireGuard service:

sudo wg-quick up wg0

To ensure WireGuard starts on boot, run the following command:

sudo systemctl enable wg-quick@wg0

Step 7: Configure Firewall Rules

If you are using UFW as your firewall, allow the WireGuard port:

sudo ufw allow 51820/udp

Enable the UFW firewall if it’s not already enabled:

sudo ufw enable

Step 8: Configure Client

On the client machine, you will need to install WireGuard and create a configuration file. Generate a key pair using the same steps as before, then create a config file similar to this:

[Interface]
PrivateKey = YOUR_CLIENT_PRIVATE_KEY
Address = 10.0.0.2/24

[Peer]
PublicKey = YOUR_SERVER_PUBLIC_KEY
Endpoint = YOUR_SERVER_IP:51820
AllowedIPs = 0.0.0.0/0
            

Start the client using:

sudo wg-quick up wg0