How do I set up a WireGuard VPN on a VPS?
You can have a working WireGuard endpoint in about fifteen minutes: deploy a small KVM VPS, install WireGuard, generate a key pair, write a short config and bring the interface up. The Nano plan at $2.90/month is enough, and because NimbusVPS gives you a real kernel the WireGuard module loads without any host-side approval.
WireGuard is the simplest modern VPN to run yourself: a few hundred lines of kernel code, one config file, and a single UDP port. This guide sets up a full-tunnel endpoint that routes all of a client's traffic out through your VPS.
Prerequisites: a KVM VPS running a recent Debian or Ubuntu (the Nano plan is sufficient), root access, and the client device you want to connect. NimbusVPS deploys the box within 5 minutes of payment confirmation and includes the IPv4 address you will need below.
- 1
Deploy and update the server
Order a Nano-sized KVM VPS with Debian 12 or Ubuntu 24.04, SSH in as root, and run apt update && apt -y upgrade so the kernel and packages are current before you start.
- 2
Install WireGuard
Install the tools with apt -y install wireguard. On a real KVM VPS the kernel module is already present; there is nothing to compile because you control the kernel.
- 3
Generate the server keys
Run wg genkey | tee /etc/wireguard/private.key | wg pubkey > /etc/wireguard/public.key and chmod 600 /etc/wireguard/private.key. Keep the private key on the server; the public key goes to clients.
- 4
Write /etc/wireguard/wg0.conf
Create the interface config with the server private key, an address such as 10.8.0.1/24, ListenPort 51820, and a PostUp/PostDown nftables masquerade rule so client traffic is NATed out of the VPS public IP.
- 5
Enable IP forwarding
Set net.ipv4.ip_forward=1 (and the IPv6 equivalent if used) in /etc/sysctl.d/99-wireguard.conf and apply it with sysctl --system, so the box will route rather than drop client packets.
- 6
Add a client peer
Generate a key pair on the client, add a [Peer] block to wg0.conf with the client public key and AllowedIPs 10.8.0.2/32, and on the client set AllowedIPs = 0.0.0.0/0 to send all traffic through the tunnel.
- 7
Bring the tunnel up
Start and persist the interface with systemctl enable --now wg-quick@wg0, open UDP 51820 in any firewall, and confirm with wg show. Connect the client and verify your public IP is now the VPS.
Verifying it works: from the client, check that your public IP is the VPS address and that DNS is not leaking. Abuse handling: a personal VPN endpoint is explicitly permitted; there is no need to flag it. Bandwidth: overage is never billed — a heavy month throttles the port to 10 Mbps rather than generating an invoice.
Frequently asked questions
How long does it take to set up WireGuard on a VPS?
About fifteen minutes end to end on a fresh server: install, generate keys, write one config file and bring the interface up. The Nano plan at $2.90/month is enough hardware, and NimbusVPS deploys it within 5 minutes of payment confirmation.
Do I need a special VPS to run WireGuard?
You need full KVM virtualisation with your own kernel, which NimbusVPS provides on every plan. The WireGuard kernel module loads normally there. On OpenVZ or other shared-kernel platforms, module availability is the host's decision, which is why they are a poor choice for this.
More guides
Deploy a server for this in under 5 minutes — no ID, crypto payment.
Deploy in the next five minutes.
Pick a location, size the box, pay in crypto. No account signup wall, no ID, no waiting on a human.
7-day money-back guarantee · No KYC · Cancel any time from the panel