How to Setup WireGuard VPN on a VPS | The Ubuntu Guide

VPS technology itself is more or less efficient at getting users a new IP address, masking their original local IP address. Still, certain users seek more security and anonymity in the online world, and for good reason. It’s no secret that online privacy is increasingly slipping away. Therefore, many users have started using VPS and VPN together with each other. Some use VPS servers as VPN servers, while others use VPN on their VPS servers, meaning they install and manage their VPS with an active VPN. Wireguard, along with other popular options such as OpenVPN and Cisco variants, is a very popular choice, mostly because it is inherently configurable and can be adapted to the OS you are going to use and can even be used for reverse proxy operations. This gave birth to VPS servers that some have dubbed WireGuard VPS.

In this post, we are going to familiarize ourselves with Wireguard VPN, its benefits and features as well as how to install it on our Ubuntu VPS server. We’re also going to explore WireGuard VPN’s famous reverse proxy feature!

What is WireGuard VPN?

WireGuard VPN is a creatively new VPN client and service that functions primarily as a communication protocol. Originally in 2015 Jason A. It has since evolved into open-source VPN software, Donenfeld wrote. Despite its young age, Wireguard VPN is known for its flexibility and countless features. WireGuard is still in active development and aims to add more features. Wireguard transmits data over the UDP protocol as its primary VPN protocol. One of the main promises of Wireguard VPN is to increase performance so that it can outperform trusted rival protocols like OpenVPN and IPsec.

WireGuard is also known for its minimalistic approach to user interface and ease of operation with end-user priority. Configuring other VPN clients can often be a pain; There are many options and buttons to click WireGuard only uses the UDP protocol, so you won’t get confused with different options and the installation process is also quite simple.

All in all, it’s easy to tell that Wireguard is aiming to be an all-in-one VPN package for advanced and novice users alike. But what are some of the key benefits of Wireguard?

WireGuard VPN Advantages

Wireguard VPN has a number of unique features that make it reliable and popular enough to be used for what many describe as Wireguard VPS. These advantages include, but are not limited to:

• Advanced cryptography including protocols such as Poly1305, Curve25519, HKDF, Noise Protocol Framework, ChaCha20, BLAKE2, and SipHash24.
• Sound and easy-to-understand security, easily adjustable and configurable with just a few lines of code.
• Reverse proxy implementation.
• An easy-to-use installation and user-friendly user interface
• Open source development scheme, which allows you to modify the program according to your needs or contribute to the program.
• Advanced AED-256 encryption provides complete data security.
• Built-in roaming configuration allows efficient data allocation per end user.
• A lightweight program that runs on any device.
• The UDP protocol allows for incredibly fast & low-latency VPN options.
• An incredibly high number of supported platforms including Android, iOS, Linux, FreeBSD, NetBSD, OpenBSD, macOS, and Windows versions since 7.

WireGuard’s high configurability and the amount of resources it supports make it ideal for VPS users who can switch between device and OS options. Now let’s come to the installation process. We start with Ubuntu as a representative of Linux.

WireGuard VPS Setup (Ubuntu)

Setting up WireGuard VPS on Ubuntu VPS is no different than installing it on a local system, with the notable difference that you must first log into your VPS account. So before doing anything, make sure you are logged in with the protocol you use for your VPS server. Typically, but not necessarily, the protocol for Ubuntu is SSH, and for Windows, it’s RDP.

Prerequisites

You will need a non-root user with sudo access to execute the commands we are going to use to install WireGuard on the VPS. If you are going to host a WireGuard VPN on your WireGuard VPS, you need two separate Ubuntu servers and versions with matching patches, one for hosting and one for acting as a client; If you don’t want to host, skip this optional step, and a single sudo access account is sufficient.

Step 1: Update your repository

Installing any program in Ubuntu starts with updating repositories and system packages. So to update them enter the following command:

$ sudo apt update

Step 2: Get the WireGuard VPN files

Now we go directly to the following command to download and install WireGuard VPN:

$ sudo apt install wireguard -y

Wait for the files to be downloaded and installed.

Step 3: Obtain the private and public keys

You will need these keys to run Wireguard VPN on your Ubuntu. To get the private key enter the following command:

$ wg genkey | sudo tee /etc/wireguard/private.key

And then following command to get public key:

$ sudo cat /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key

Step 4: Set up your IPv4 & IPv6 configuration

As part of your Wireguard VPS server, I’m going to use a random IP range, but you can replace the address on the command line to create your own IP range. Use nano in the following command:

$ sudo nano /etc/wireguard/wg0.conf

Then enter the following line to configure the IP range

[Interface]

PrivateKey = servers_generated_private_key

Address = 172.16.0.0/12

ListenPort = 51820

SaveConfig = true

In the prompt, save the resulting file.

Step 5: Configure port forwarding and /etc/sysctl.conf file

Here we need to change the line in the above folder so that the connection can happen later. Enter the first command to fetch the /etc/sysctl.conf file:

$ sudo nano /etc/sysctl.conf

Then add the following lines one by one to enable forwarding:

net.ipv4.ip_forward=1

Then these lines, if you are going to use IPv6:

net.ipv6.conf.all.forwarding=1

Open Terminal and issue the following commands to read your input and output values:

$ sudo sysctl -p

net.ipv4.ip.forward = 1

And the following for IPv6:

net.ipv6.conf.all.forwarding = 1

Step 6: Adjust the firewall (optional)

In this step, we need to configure the firewall for the many network-enabled programs installed on Ubuntu. First, find the public network interface for your server with the following command:

$ ip route list default

and then find this line in the output:

default via XXX.XXX.XXX.XXX dev eth0 online

Eth0 refers to the public network interface. You need to add it to your IP table. Import the configuration file:

$ sudo nano /etc/wireguard/wg0.conf

Navigate to the very end of the file and add the following block of text, just copy and paste:

PostUp = ufw root allow wg0 out on eth0

postup = iptables -t nat -I POSTROUTING -o eth0 -j masquerade

PostUp = ip6tables -t nat -I POSTROUTING -o eth0 -j MASQUERADE

predown = ufw allows root deletion wg0 out on eth0

predown = iptables -t nat -D POSTROUTING -o eth0 -j masquerade

PreDown = ip6tables -t nat -D POSTROUTING -o eth0 -j masquerade

Move the lines depending on whether you are going to use IPv4 or IPv6. Now let’s get to the important part of making an exception for the UDP ports that WireGuard runs on. By default, this port is 51820. So we have to open this port. Enter the command:

$ sudo ufw allow 51280/udp

Now quickly enable and disable UFW to load your changes:

$ sudo ufw disable

$ sudo ufw enable

Now check the UFW rules with the commands below:

$ sudo ufw status

The output should be like this:

To Action From

— —— —-

51820/udp ALLOW Anywhere

OpenSSH ALLOW Anywhere

51820/udp (v6) ALLOW Anywhere (v6)

OpenSSH (v6) ALLOW Anywhere (v6)

Step 7: Configuring the Server

Now your WireGuard client is installed and ready to connect. You can use any server you build or buy to connect using it. If you want to create your own WireGuard VPS server to use as a VPN, you can follow these steps. We’re going to use a three-line command sequence to make this happen. The first command will enable WireGuard to start with every boot and reboot.

The second line starts the service and the 3rd  will keep it running. Enter one command at a time:

$ sudo systemctl enable [email protected]

$ sudo systemctl start [email protected]

$ sudo systemctl status [email protected]

Congratulations, you have finally launched the client and your own server. You can use the client to connect to another server, or you can boot the WireGuard client on another system and connect to your own WireGuard VPS host that acts as a VPN.

WireGuard Reverse Proxy

One of the most important features of WireGuard VPS is the ability to use it in a reverse proxy operation in conjunction with tools like Nginx. Reverse proxies are effective in preventing internet censorship. They are quite useful in facilitating more efficient data flow from specific programs and applications to the destination host. Here is a brief guide to using WireGuard reverse proxy with Nginx.

Step 1: Install Nginx

Enter the following command to install Nginx:

sudo apt update -y && sudo apt install -y nginx

Then enter this line to get the Nginx web server up and running:

sudo systemctl start nginx

Step 2: Configure Nginx

Open the following configuration file using superuser access:

    /etc/nginx/nginx.conf

Now find the part that reads “stream{” and add these extra lines there:

server {

        listen 80 udp;

        proxy_pass 127.0.0.1:51820;

    }

Exit Nano and run the following command to check the Nginx config file:

sudo nginx -t

With these lines, you have now enabled port 80, which is required to run a reverse proxy.

Step 3: Connect via HTTP port 80

Now it’s time to step things up and connect a reverse proxy, which will allow multiple devices to connect to the VPN through a blocked network and perform better. First, bring the computer’s tunnel set up file to make the active HTTP port 80 instead of 51820. Then run WireGuard and connect it, which will create a reverse proxy on the network using port 80.

Best way to connect VPS to the home network

Many people who travel a lot and need a static IP of their work or home network to perform certain tasks can use Wireguard VPN on their VPS server to connect to their home and work network via VPS. To do this, a VPS server and a VPN installed on that server are required WireGuard has a built-in feature to do this. So it is one of the best and most efficient platforms to connect your VPN to your home network. This deployment of an Ubuntu VPS creates a unique and satisfying WireGuard VPN test.

Conclusion

If you need a VPS server to run your Wireguard VPN, you can opt for CloudG’s elite Ubuntu Linux VPS. It comes with the latest updates and more than 15 different data centers to choose from It has excellent compatibility with various VPN services, including WireGuard, and will help you connect the VPS to your work or home network as well as perform reverse proxy-like operations.