How do I set up a WireGuard VPN on a VPS?
To set up a self-managed WireGuard endpoint, deploy a KVM VPS, install WireGuard on a supported Linux guest, configure keys and forwarding, and test the tunnel. The Nano plan at $8.26 for 3 months in Amsterdam is an entry configuration for light use; throughput depends on the workload and route.
WireGuard uses key pairs and a network interface configuration to create an encrypted tunnel. This guide sets up a full-tunnel endpoint that routes all of a client's traffic out through your VPS.
Prerequisites: a KVM VPS running a supported Debian or Ubuntu release, root access, and a client device. Check the delivered IP and interface names before applying networking rules. NimbusVPS checkout asks for an email address, with no ID upload or phone verification. Email and order records are retained. Payments are verified automatically; server preparation follows confirmation.
Prices shown are for one server in Amsterdam, free Linux and no paid add-ons, with the three-month minimum term prepaid. Location, operating system and options change the total.
- 1
Deploy and update the server
Order a Nano-sized KVM VPS with Debian 12 or Ubuntu 24.04, SSH in as root, and run apt update && apt -y upgrade so the kernel and packages are current before you start.
- 2
Install WireGuard
Install the tools with apt -y install wireguard. Use a supported guest kernel with WireGuard support and verify the module is available before configuring the tunnel.
- 3
Generate the server keys
Run wg genkey | tee /etc/wireguard/private.key | wg pubkey > /etc/wireguard/public.key and chmod 600 /etc/wireguard/private.key. Keep the private key on the server; the public key goes to clients.
- 4
Write /etc/wireguard/wg0.conf
Create the interface config with the server private key, an address such as 10.8.0.1/24, ListenPort 51820, and a PostUp/PostDown nftables masquerade rule so client traffic is NATed out of the VPS public IP.
- 5
Enable IP forwarding
Set net.ipv4.ip_forward=1 (and the IPv6 equivalent if used) in /etc/sysctl.d/99-wireguard.conf and apply it with sysctl --system, so the box will route rather than drop client packets.
- 6
Add a client peer
Generate a key pair on the client, add a [Peer] block to wg0.conf with the client public key and AllowedIPs 10.8.0.2/32, and on the client set AllowedIPs = 0.0.0.0/0 to send all traffic through the tunnel.
- 7
Bring the tunnel up
Start and persist the interface with systemctl enable --now wg-quick@wg0, open UDP 51820 in any firewall, and confirm with wg show. Connect the client and verify your public IP is now the VPS.
Verifying it works: from the client, check that your public IP is the VPS address and that DNS is not leaking. Abuse handling: a personal VPN endpoint is explicitly permitted; there is no need to flag it. Bandwidth: overage is never billed โ a heavy month throttles the port to 10 Mbps rather than generating an invoice.
Frequently asked questions
How long does it take to set up WireGuard on a VPS?
Setup time depends on the Linux guest, networking and your experience. Start after the server has been delivered, then install WireGuard, configure keys and forwarding, and test connectivity. Payments are verified automatically; server preparation follows confirmation. No fixed activation or setup time is stated.
Do I need a special VPS to run WireGuard?
A KVM VPS with a supported Linux guest lets you manage the guest kernel and networking. Confirm WireGuard support in the selected operating system, allow the chosen UDP port and enable the forwarding rules your tunnel needs.
More guides
Pay with crypto without an ID upload at checkout. Payments are verified automatically; server preparation follows confirmation.
Choose your server and see the total.
Choose your location, resources and term. Pay in crypto after reviewing the total; payment is verified automatically before your VPS is prepared.
Minimum 3-month VPS term ยท No ID upload in checkout ยท 7-day refund policy with exclusions