WireGuard is a VPN built into the Linux kernel. vpsAdminOS provides the required module, so you only need to install the userspace tools inside your VPS.

This example connects two devices:

• the server at vpsFree.cz has the public address 185.8.164.10/32, UDP port 51820 and VPN address 10.77.0.1;
• the client has VPN address 10.77.0.2.

185.8.164.10/32 is an example from the playground VPS range. Replace it with the server's real public IPv4 or IPv6 address. Enclose a literal IPv6 address in brackets in Endpoint, for example Endpoint = [2001:db8::10]:51820.

Install the wireguard-tools package from your distribution. For example:

# Debian and Ubuntu
apt update
apt install wireguard-tools
 
# Fedora
dnf install wireguard-tools
 
# Alpine Linux
apk add wireguard-tools
 
# Arch Linux
pacman -S wireguard-tools

The WireGuard project website links to current instructions for other systems.

Create a separate key pair on both the server and the client. Never send the private key to anybody or put it in a ticket or public repository.

install -d -m 700 /etc/wireguard
umask 077
wg genkey | tee /etc/wireguard/private.key | wg pubkey > /etc/wireguard/public.key

Display the public key with:

cat /etc/wireguard/public.key

In the examples below, replace SERVER_PRIVATE_KEY, SERVER_PUBLIC_KEY, CLIENT_PRIVATE_KEY and CLIENT_PUBLIC_KEY with the corresponding values. Keep the configuration file readable by root only.

Create /etc/wireguard/wg0.conf on the server:

[Interface]
Address = 10.77.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
 
[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.77.0.2/32

Create /etc/wireguard/wg0.conf on the client:

[Interface]
Address = 10.77.0.2/24
PrivateKey = CLIENT_PRIVATE_KEY
 
[Peer]
PublicKey = SERVER_PUBLIC_KEY
AllowedIPs = 10.77.0.1/32
Endpoint = 185.8.164.10:51820
PersistentKeepalive = 25

AllowedIPs specifies the addresses routed to the peer as well as the source addresses WireGuard accepts from it. This example routes traffic only between the two VPN addresses. It does not make the VPS a default gateway and does not configure NAT.

Use PersistentKeepalive = 25 when the client is behind NAT or a stateful firewall and has to remain reachable without sending other traffic. You can omit it when both peers are directly reachable. At least the side initiating the connection needs an Endpoint; in this example, the server learns the client endpoint from received packets.

On both machines, allow only root to read the configuration:

chmod 600 /etc/wireguard/wg0.conf

If the server uses a firewall, allow incoming UDP port 51820 for IPv4 and IPv6 as appropriate for the Endpoint address. The TCP port with the same number is not needed. See Firewall for details.

On a distribution with systemd, start the interface and enable it at boot:

systemctl enable --now wg-quick@wg0

On a system without systemd, you can start it directly:

wg-quick up wg0

Verify the configuration with:

wg show
ping -c 3 10.77.0.1   # on the client
ping -c 3 10.77.0.2   # on the server

In wg show, pay particular attention to the latest handshake time and the transfer counters. If there is no handshake, check the public keys, Endpoint and firewall rules. The official WireGuard quick start explains the configuration in more detail.