How To Set Up A WireGuard VPN On Your Cloud Server

UKHost4u Team 12/11/2026 Comments Off on How To Set Up A WireGuard VPN On Your Cloud Server

WireGuard is a modern VPN: fast, simple to set up and built into the Linux kernel. With your own WireGuard server you can connect securely from public Wi-Fi, reach private services on your servers without exposing them to the internet, or give your team a fixed IP address to work from.

This guide sets up a WireGuard server on an Elastic VPS in UKHost4u Cloud Solutions running Ubuntu 24.04, then connects a laptop or phone to it. It works the same way on our VPS hosting or a dedicated server running Ubuntu.

What you need

• A UKHost4u Cloud Solutions account. If you do not have one yet, see how to register your Cloud Solutions account; new accounts start with a free trial.
• The WireGuard app on each device you want to connect, from wireguard.com, the App Store or Google Play.

1. Create the server

1. In the cloud dashboard, click New Environment.
2. Choose Elastic VPS with Ubuntu 24.04.
3. Turn on Public IPv4 for the node, so your devices can reach it from the internet.
4. A small server is enough for a VPN: set the scaling limit to a few cloudlets. WireGuard uses very little memory and CPU, and you only pay for what it uses.
5. Click Create.

When the environment is ready, note its public IP address and connect to it over SSH: see UKHost4u SSH access and how to configure the Elastic VPS.

2. Install WireGuard

Update the system and install WireGuard:

sudo apt update && sudo apt upgrade -y
sudo apt install -y wireguard

Check that WireGuard can run on the server:

sudo ip link add dev wgtest type wireguard && sudo ip link delete dev wgtest && echo "WireGuard OK"

If this does not print WireGuard OK, submit a ticket and our team will check the server for you.

3. Create the server keys

WireGuard uses a pair of keys for each end of the connection. Create the server’s pair and keep the private key readable by root only:

sudo sh -c 'umask 077; wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub'
sudo cat /etc/wireguard/server.pub

The second command shows the server’s public key. You will need it for each device. Never share the private key.

4. Configure the server

Find the name of the server’s network interface (often eth0 or venet0):

ip route show default

The name follows dev in the output. Then create the configuration file:

sudo nano /etc/wireguard/wg0.conf

Paste the following, replacing SERVER-PRIVATE-KEY with the contents of /etc/wireguard/server.key and eth0 with your interface name:

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = SERVER-PRIVATE-KEY
# Let VPN clients use the server's internet connection
PostUp = iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Turn on packet forwarding, so the server can pass traffic between the VPN and the internet:

echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/99-wireguard.conf
sudo sysctl --system

5. Open the firewall and start WireGuard

WireGuard listens on UDP port 51820. If the server uses UFW, allow it, together with SSH so you do not lock yourself out:

sudo ufw allow OpenSSH
sudo ufw allow 51820/udp
sudo ufw enable

If you have turned on the container firewall for the node in the cloud dashboard, add an inbound rule for UDP port 51820 there too.

Start WireGuard and make it start automatically after a restart:

sudo systemctl enable --now wg-quick@wg0
sudo wg show

wg show should list the wg0 interface listening on port 51820.

6. Add a device

In the WireGuard app on your laptop or phone, create a new empty tunnel. The app creates a key pair: copy its public key.

On the server, add the device as a peer, giving each device its own address in the VPN:

sudo wg set wg0 peer DEVICE-PUBLIC-KEY allowed-ips 10.8.0.2/32
sudo wg-quick save wg0

wg-quick save writes the new peer into wg0.conf, so it is kept after a restart. Use 10.8.0.3/32 for the next device, and so on.

In the app, complete the tunnel like this, using the server’s public key and public IP address:

[Interface]
PrivateKey = (created by the app)
Address = 10.8.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER-PUBLIC-KEY
Endpoint = SERVER-PUBLIC-IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

AllowedIPs = 0.0.0.0/0 sends all of the device’s internet traffic through the VPN. To use the VPN only to reach your servers, put just their private network instead, for example AllowedIPs = 10.8.0.0/24.

7. Test the connection

Turn the tunnel on in the app. On the server, run:

sudo wg show

The device should appear with a latest handshake a few seconds ago. On the device, visit a site that shows your IP address: it should now show the server’s public IP.

Removing a device

If a device is lost or no longer needs access, remove its peer and save:

sudo wg set wg0 peer DEVICE-PUBLIC-KEY remove
sudo wg-quick save wg0

Need help?

We use WireGuard ourselves. If you would like help setting up a VPN on your cloud server, VPS or dedicated server, submit a ticket.

About UKHost4u Team

View all posts by UKHost4u Team →