How to VPN – Setup WireGuard

You can setup a fast, modern VPN tunnel called WireGuard, this is ideal for those who want a secure, private connection to route their traffic through their own server. WireGuard is lightweight, quick to configure and offers excellent performance compared to older VPN protocols like OpenVPN. We will be setting it up on your Packetra server.

This article assumes you are already logged into your VPS/Dedicated Server. Don’t have an account with us, feel free to sign up over at our Portal. Once registered check out our selection of VPS and Dedicated Servers.
Already have one? Then feel free to proceed to follow the how-to guide below.

Select your Linux OS to Install WireGuard

First, before we start you must select the OS in the tab to which you are installing WireGuard. If your OS is not in the list, you can look online on how to install WireGuard for your particular OS flavour.

Find your Interface and Public IP address

First, lets find out the interface and IP address

ip route get 8.8.8.8

Example: 8.8.8.8 via x.x.x.x dev ens18 src y.y.y.y uid 0 – This will give you your IP as well as Interface to which the profile will be built on.

Enable IP Forwarding

Next, we need to enable IP Forwarding, this way, taffic routes between the tunnel and the internet. This settings will persist across reboots.

echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-wireguard.conf
sysctl -p /etc/sysctl.d/99-wireguard.conf

Generate Server & Client Keys

First, this command creates one key pair for the server and one for the client, the server is where the software runs from, the client key is for the .conf file you will be using later after downloading the WireGuard app which you can find here

mkdir -p /etc/wireguard && cd /etc/wireguard
umask 077
wg genkey | tee server.key | wg pubkey > server.pub
wg genkey | tee client.key | wg pubkey > client.pub
cat server.key server.pub client.key client.pub

Then your terminal returns the values in this order: server private, server public – client private, client public. Keep the private keys a secret.

Write the server configuration

Create the file below at /etc/wireguard/wg0.conf . Substitute your keys, WAN_IFACE , and YOUR_PUBLIC_IP. Note: You are not bound to use SNAT, you can definitely use MASQUERADE if you prefer, but for this example, we will use SNAT to send the traffic to the exact outgoing IP address of our choosing.

[Interface]
Address = 10.10.10.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY

# SNAT tunnelled traffic to the server's public IP — required
PostUp = iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o WAN_IFACE -j SNAT --to-source
YOUR_PUBLIC_IP
PostUp = iptables -A FORWARD -i %i -o WAN_IFACE -j ACCEPT
PostUp = iptables -A FORWARD -i WAN_IFACE -o %i -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -s 10.10.10.0/24 -o WAN_IFACE -j SNAT --to-source
YOUR_PUBLIC_IP
PostDown = iptables -D FORWARD -i %i -o WAN_IFACE -j ACCEPT
PostDown = iptables -D FORWARD -i WAN_IFACE -o %i -j ACCEPT

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.10.10.2/32

Bring the tunnel up

Next we’re going to bring the tunnel up, to do that we will type the following in our VM

wg-quick up wg0
wg show

wg show should list the wg0 interface, its listening port, and the registered peer. There is no handshake yet, that appears once a client connects. To start the tunnel automatically at boot:

systemctl enable wg-quick@wg0

Set up the Client

Also, the client device needs the WireGuard app. Download the official client:

• Windows, macOS, Linux, Android, iOS — wireguard.com/install

Give the client the configuration below. You can paste it into the WireGuard app or create a .conf file and import from a file.

[Interface]
PrivateKey = CLIENT_PRIVATE_KEY
Address = 10.10.10.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = YOUR_PUBLIC_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

AllowedIPs = 0.0.0.0/0 routes all client traffic through the tunnel.
PersistentKeepalive = 25 keeps the connection alive through the client’s local network.

Verify the Connection (Public IP & Server Side

Next, activate the tunnel in the client app so you can confirm it is working. You can open a browser and goto a site like WhatIsMyIpAddress. As a result, it should show your Public IP as the IP of the server and not that of your ISP.

You can verify on the server by typing wg show to see the latest handshake and transfer data.

Final Words

You now know how to setup WireGuard to route your traffic securely through your own Packetra server. In particular, this suits those who want a fast, private VPN for everyday browsing, remote access, or keeping their traffic encrypted on untrusted networks. Keep in mind that in territories where ISP’s aggressively inspect traffic, standard WireGuard can be detected and blocked, in those cases our AmneziaWG guide is the better option.

Frequently Asked Questions

Why choose WireGuard over other VPN protocols?
WireGuard is far lighter and faster than older protocols like OpenVPN, with a much smaller codebase that is easier to audit. It connects quickly, uses modern cryptography, and performs well even on low-powered servers. It is a great choice for a personal VPN when you are not worried about active censorship.

My tunnel connects but no traffic passes. What’s wrong?
This is almost always the SNAT rule. Make sure the WAN_IFACE in your config matches the interface from the “ip route get 8.8.8.8” step, and that your public IP is correct. On a check, run “iptables -t nat -L POSTROUTING -v -n” on the server, the counters should climb as you browse. If they stay at zero, the rule is not matching your interface.

Can I connect more than one device?
Yes. Generate an additional client key pair, add another [Peer] block to the server config with the next AllowedIPs address (for example 10.10.10.3/32), and build a matching client config. Each device needs its own key pair and its own tunnel IP.

Good to Know
Your private keys must stay secret, since anyone with them can impersonate your server or client, so store your working config somewhere safe once the handshake succeeds. If browsing works but large downloads or speed tests stall, this is usually an MTU issue, you can lower the tunnel MTU on the server with “ip link set mtu 1380 dev wg0” and make it permanent by adding “PostUp = ip link set mtu 1380 dev %i” to the [Interface] section. WireGuard is an excellent, fast VPN for most needs, but if your ISP actively inspects and blocks VPN traffic, take a look at our AmneziaWG guide instead. Run into any issues? Open a support ticket through the client portal and our team will help you.