WireGuard Full Documentation

This guide explains how to install and configure a WireGuard VPN server on Ubuntu, connect clients such as Windows computers and Android phones, generate QR codes, manage multiple peers, configure routing, NAT, and port forwarding.

Introduction to WireGuard

WireGuard is a modern VPN protocol that creates an encrypted tunnel between devices. It uses public and private keys instead of usernames and passwords.

A typical setup looks like this:

Install WireGuard on Ubuntu Server

WireGuard configuration files are stored in:

The main server configuration file will be:

Check WireGuard Version

Example output:

Generate Server Keys

WireGuard uses two keys:

Check the keys:

The private key stays on the server. The public key is shared with clients.

Create WireGuard Server Configuration

Example configuration:

Replace:

with:

Replace:

with your internet interface name. For AWS EC2, it is commonly:

Check yours:

Enable IP Forwarding

IP forwarding allows Ubuntu to route traffic between WireGuard clients and the internet.

Add:

Apply changes:

Verify:

Expected output:

Firewall and NAT Configuration

Allow WireGuard Port

AWS users must also allow the port in Security Group:

NAT Explanation

The MASQUERADE rule allows VPN clients to access the internet using the Ubuntu server public IP.

Example:

Start and Enable WireGuard Service

Check status:

Check interface:

Successful output should show:

Generate Client Keys

Every WireGuard client must have its own unique key pair. Never reuse the same private key for multiple devices.

Example clients:

Create Client Directory

Generate Client 1 Keys

View keys:

Example:

The private key goes to the client device. The public key is added to the Ubuntu server.

Add Client Peer to WireGuard Server

A peer tells the server: "Allow this device to connect using this public key and assign it this VPN IP."

Edit Server Configuration

Add the client at the bottom:

Replace:

with:

Restart WireGuard:

Configure WireGuard Client on Windows

Install Application

Download and install the WireGuard Windows application.

Create Tunnel

The application automatically creates a private key.

Example configuration:

Configuration Explanation

Add Windows Public Key to Server

Copy the public key from WireGuard Windows application.

Add it to Ubuntu:

Restart:

Configure WireGuard Client on Android

Android uses the same configuration as Windows. The easiest method is importing using a QR code.

Install:

Create Client Configuration File

Example:

Insert client private key:

Insert server public key:

Generate WireGuard QR Code

Install qrencode

Display QR Code in Terminal

Open WireGuard Android application:

Create QR Image File

The PNG contains the complete WireGuard configuration.

Verify Client Connection

Activate the client tunnel, then check Ubuntu:

Successful connection:

A handshake proves that the encrypted tunnel is established.

Managing Multiple WireGuard Peers

WireGuard supports multiple clients connected to one server. Each device must have its own private key, public key, and VPN IP address.

Example network design:

Never assign the same VPN IP to two different clients.

Client IP Allocation Planning

A simple method is assigning addresses sequentially.

Server configuration example:

Recommended Client File Organization

Using names like windows, android, and office-laptop is easier than using only client1, client2.

Full Tunnel VPN Configuration

A full tunnel means all client internet traffic goes through the WireGuard server.

Traffic flow:

The internet sees the Ubuntu server public IP instead of the client's real IP.

Split Tunnel Configuration

Split tunnel sends only VPN traffic through WireGuard. Normal internet traffic uses the client's local connection.

Example:

Port Forwarding to WireGuard Clients

You can expose a service running on a WireGuard client through the Ubuntu server.

Example:

Enable Forwarding

Expected:

Add DNAT Rule

Explanation:

Allow Forward Traffic

Allow Return Traffic

The first rule allows requests to reach the client. The second allows responses to return.

AWS EC2 WireGuard Configuration

When running WireGuard on AWS, there are two firewalls:

AWS Security Group

For port forwarding:

Check AWS Interface

AWS Ubuntu usually uses:

MikroTik WireGuard Client

WireGuard support requires RouterOS 7 or newer. RouterOS 6 does not include native WireGuard.

Create Interface

Add IP Address

Add Ubuntu Peer

Add MikroTik Public Key to Ubuntu

WireGuard Troubleshooting

When WireGuard does not connect, troubleshoot in the following order:

Check WireGuard Service Status

Successful output:

If failed:

View detailed error:

Check WireGuard Interface

Example working output:

Important values:

Problem: No Handshake

If you see:

Check the following.

1. Check Server Port

Expected:

2. Check AWS Security Group

3. Check UFW

Allow WireGuard:

4. Check Client Endpoint

Common mistakes:

UFW Permission Error

A common error:

Cause:

Check UFW permissions:

Correct permission example:

Fix:

Restart:

Check IP Forwarding

Correct:

Enable permanently:

Add: Apply:

Check iptables Rules

Check NAT: Expected:

Make iptables Rules Persistent

iptables rules disappear after reboot unless saved.

Install persistence package: Save current rules: Restore automatically:

Check Logs

WireGuard Logs

Follow live:

Kernel Logs

WireGuard Security Best Practices

1. Protect Private Keys

Never share: Only share:

2. Use Unique Keys

3. Remove Lost Devices

If a phone or laptop is lost, remove its peer.

Edit: Delete: Restart:

Backup WireGuard Configuration

Backup folder: Compress:

Useful WireGuard Commands

Production Deployment Checklist

Final Network Example

This completes the WireGuard server and client deployment guide.