Why WireGuard for Dedicated Server Access
Exposing SSH, database ports, or admin panels directly to the public internet is one of the most common ways dedicated servers get compromised. A VPN closes that exposure: instead of opening ports to the world, you open them only to devices connected through an encrypted tunnel.
WireGuard has become the default choice for this over older options like OpenVPN, for a few concrete reasons. Its codebase is a fraction of the size — easier to audit, fewer places for vulnerabilities to hide. It uses modern, fixed cryptographic primitives rather than negotiable cipher suites, which removes a whole category of misconfiguration risk. And because it operates at the kernel level on Linux, connection setup and throughput are noticeably faster than userspace VPN implementations.
This guide sets up a WireGuard server on a bare-metal dedicated server and connects a client device to it, with routing configured so you can securely reach internal services that aren't exposed publicly.
What You'll Need
- A dedicated server running Ubuntu 24.04 LTS with root or sudo access
- A client device (laptop, desktop, or phone) to connect from
- Roughly 15 minutes
Step 1: Install WireGuard
Ubuntu 24.04 ships WireGuard in the default repositories, so installation is a single command:
sudo apt update
sudo apt install wireguard -y
Step 2: Generate Server Keys
WireGuard uses public-key cryptography instead of usernames and passwords. Generate a key pair for the server:
cd /etc/wireguard
umask 077
wg genkey | tee server_private.key | wg pubkey > server_public.key
Keep server_private.key confidential — it never needs to leave the server.
Step 3: Configure the Server Interface
Create the main configuration file:
sudo nano /etc/wireguard/wg0.conf
Add the following configuration, replacing eth0 with your server's actual public network interface name (check with ip a if unsure):
[Interface]
Address = 10.10.0.1/24
ListenPort = 51820
PrivateKey =
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
# Client peers will be added below
Step 4: Enable IP Forwarding
WireGuard needs the kernel to forward packets between the VPN tunnel and the wider network:
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p
Step 5: Open the Firewall Port
If you're using UFW, allow the default WireGuard port and SSH:
sudo ufw allow 51820/udp
sudo ufw allow OpenSSH
sudo ufw enable
WireGuard runs over UDP, not TCP — make sure any upstream firewall or security group allows UDP traffic on the port you chose.
Step 6: Generate a Client Key Pair
On the client machine (or on the server, then transfer securely), generate keys the same way:
wg genkey | tee client_private.key | wg pubkey > client_public.key
Step 7: Add the Client as a Peer
Back on the server, append the client's public key to wg0.conf:
[Peer]
PublicKey =
AllowedIPs = 10.10.0.2/32
Each client gets its own [Peer] block and its own address in the 10.10.0.0/24 range.
Step 8: Start the WireGuard Interface
Enable and start the service so it comes up automatically on boot:
sudo systemctl enable --now wg-quick@wg0
sudo systemctl status wg-quick@wg0
Confirm the interface is up:
sudo wg show
Step 9: Configure the Client
On the client device, create its own config file pointing back at the server:
[Interface]
PrivateKey =
Address = 10.10.0.2/24
DNS = 1.1.1.1
[Peer]
PublicKey =
Endpoint = your.server.ip:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
Setting AllowedIPs = 0.0.0.0/0 routes all client traffic through the tunnel — full VPN mode. If you only need access to the server's internal network rather than full traffic routing, scope AllowedIPs down to the specific subnet instead, for example 10.10.0.0/24.
Connect from the client using the official WireGuard app (available for Windows, macOS, Linux, iOS, and Android), or via CLI:
sudo wg-quick up wg0
Step 10: Lock Down Direct Access to Sensitive Ports
With the VPN working, the next step is restricting SSH and any admin interfaces to only accept connections from the WireGuard subnet:
sudo ufw delete allow OpenSSH
sudo ufw allow from 10.10.0.0/24 to any port 22
This is the actual payoff: SSH is no longer reachable from the open internet at all, only from devices that have already authenticated through the VPN tunnel.
Frequently Asked Questions
Is WireGuard secure enough for production use?
Yes. WireGuard has undergone formal security audits and uses well-vetted modern cryptography (ChaCha20, Curve25519, BLAKE2s). It's included in the mainline Linux kernel, which reflects a high level of scrutiny from the kernel security community.
Is WireGuard better than OpenVPN?
For most use cases, yes — WireGuard offers simpler configuration, smaller attack surface, and better throughput. OpenVPN remains relevant where TCP-based VPN traffic is required to bypass restrictive firewalls, since WireGuard is UDP-only.
Can I run multiple clients on the same WireGuard server?
Yes. Add a separate [Peer] block with a unique key pair and IP address for each client device or user.
Does WireGuard slow down my connection?
WireGuard's overhead is minimal compared to older VPN protocols — it's specifically designed for high throughput with low latency, which is why it performs well even on resource-constrained devices.
What happens if the server reboots?
With the systemd service enabled (enable --now), the WireGuard interface comes back up automatically on boot.
Setting this up on an eServers bare-metal dedicated server gives WireGuard a dedicated network stack with no noisy-neighbour contention — important for a service where consistent low latency is the whole point.
Discover eServers Dedicated Server Locations
eServers provides reliable dedicated servers across multiple global regions. Whether you need low latency, regional compliance, or proximity to your audience, our wide geographic coverage ensures the perfect hosting environment for your project.
