WireGuard itself is very light.

An ordinary 1-core, 1GB VPS can run it, and even 512MB of RAM can handle light use. What really affects the experience isn't CPU, but:

If you're in mainland China and want low latency, usually look first at locations like Hong Kong, Japan, Singapore, and the US West Coast. Don't just look at "1Gbps bandwidth" — the line during peak hours is what matters.

If you only use it to remotely access internal network services, the server can be closer to you; if it's for isolating cross-border business environments, first check the target platform's requirements for IP, region, and stability.

Recommended systems:

• Ubuntu 22.04 / 24.04
• Debian 12

The commands below use Ubuntu / Debian as examples.

First update the system:

apt update
apt upgrade -y

Install WireGuard:

apt install wireguard -y

Confirm the command is available:

wg --version

If you see a version number, it's installed.

First enter the WireGuard config directory:

cd /etc/wireguard
umask 077

Generate the server key:

wg genkey | tee server_private.key | wg pubkey > server_public.key

Generate a client key:

wg genkey | tee client_private.key | wg pubkey > client_public.key

View the keys:

cat server_private.key
cat server_public.key
cat client_private.key
cat client_public.key

Note here:

• Never share the private key with anyone
• The public key can go into the peer configuration
• It's best to generate a separate key pair for each client

Don't have all your phones and computers share the same client config. If a device is lost later, it will be very hard to revoke it individually.

First confirm your network interface name:

ip route get 8.8.8.8

You'll usually see something like:

dev eth0

It could also be ens3, ens5, or enp1s0. The example below uses eth0; change it to your actual interface name.

Create the config:

nano /etc/wireguard/wg0.conf

Write in:

[Interface]
Address = 10.66.66.1/24
ListenPort = 51820
PrivateKey = 服务端私钥

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = 客户端公钥
AllowedIPs = 10.66.66.2/32

Replace these two places:

• 服务端私钥: the output of cat server_private.key
• 客户端公钥: the output of cat client_public.key

If your public network interface isn't eth0, also change eth0 in PostUp / PostDown to the real interface name.

WireGuard only builds the tunnel. For clients to go out through the VPS, you also need to enable IPv4 forwarding.

Edit:

nano /etc/sysctl.conf

Add or uncomment:

net.ipv4.ip_forward=1

Make it take effect:

sysctl -p

Confirm:

sysctl net.ipv4.ip_forward

If you see:

net.ipv4.ip_forward = 1

You're good.

WireGuard's default port is 51820/udp.

If you use UFW:

ufw allow 51820/udp
ufw status

If you use a cloud provider security group, open it in the console too:

UDP 51820
来源：你的 IP 或 0.0.0.0/0

This is the easiest thing for beginners to miss:

• The firewall inside the VPS is open
• The cloud platform security group is not

The result is that the client can scan all it wants and still can't connect.

If you're not sure whether it's a port problem, first check whether the server is listening:

ss -lunp | grep 51820

Start:

systemctl start wg-quick@wg0

Enable on boot:

systemctl enable wg-quick@wg0

Check status:

systemctl status wg-quick@wg0
wg show

If the config is written correctly, wg show will show the interface and Peer information.

If startup fails, check the logs first:

journalctl -u wg-quick@wg0 -b --no-pager

Common errors:

• Private key copied incorrectly
• Wrong interface name in PostUp
• Config file permissions too open
• Address conflicts with the client subnet

The client config can be called client.conf:

[Interface]
PrivateKey = 客户端私钥
Address = 10.66.66.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = 服务端公钥
Endpoint = 你的VPS公网IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Replace:

• 客户端私钥: cat client_private.key
• 服务端公钥: cat server_public.key
• 你的VPS公网IP: the VPS's public IP

The most critical part here is AllowedIPs.

If you want all traffic to go through the VPS:

AllowedIPs = 0.0.0.0/0

If you only want to access the WireGuard internal network, e.g. only 10.66.66.0/24:

AllowedIPs = 10.66.66.0/24

If you're a beginner and just want "everything through the VPN," use 0.0.0.0/0.

The official WireGuard client supports:

• Windows
• macOS
• Linux
• iOS
• Android

On desktop you can import client.conf directly.

On mobile, a QR code is more convenient.

Install the QR code tool on the VPS:

apt install qrencode -y

Generate the QR code:

qrencode -t ansiutf8 < client.conf

Then open the WireGuard app on your phone and choose scan to import.

Note: the QR code contains the client private key. Don't screenshot it into a group chat, and don't put it in public documents.

The most common WireGuard problem isn't failing to install, but "shows connected, but web pages won't open."

Check in this order.

wg show

sysctl net.ipv4.ip_forward

net.ipv4.ip_forward = 1

iptables -t nat -S | grep MASQUERADE

ip route get 8.8.8.8

ping 1.1.1.1
ping google.com

DNS = 1.1.1.1

Don't copy the same client.conf to all devices.

Each device should have its own:

• private key
• public key
• internal IP

For example, a second device:

10.66.66.3/32

Add to the server's wg0.conf:

[Peer]
PublicKey = 第二台客户端公钥
AllowedIPs = 10.66.66.3/32

After editing, reload:

systemctl restart wg-quick@wg0

If you later want to kick out a device, just delete that device's corresponding [Peer].

WireGuard is great, but it's not a cure-all.

Think carefully about these situations:

• Your network frequently blocks UDP
• You need complex obfuscation and anti-blocking capability
• You have no idea how to maintain a Linux firewall
• Your VPS has little traffic, but you plan to route all your family's devices through it
• The target business is very sensitive to IP risk control and can't casually share exits

Especially the last point: if you use WireGuard to share one exit IP across multiple accounts and multiple businesses, it's easy to mix environments together. When doing cross-border accounts, e-commerce, TikTok, and similar businesses, don't cut corners by sharing carelessly.

If you can't connect after configuring it, go in this order:

1. systemctl status wg-quick@wg0: is the service started
2. wg show: is there a handshake
3. ss -lunp | grep 51820: is the port listening
4. Cloud platform security group: is UDP 51820 opened
5. sysctl net.ipv4.ip_forward: is forwarding enabled
6. iptables -t nat -S | grep MASQUERADE: did NAT take effect
7. ip route get 8.8.8.8: is the public interface name correct
8. Client Endpoint: are the IP and port wrong
9. Client AllowedIPs: global proxy or internal network only
10. DNS: if you can ping IPs but can't open domain names, check DNS first

The good thing about WireGuard is that the config file is short and problems are fairly concentrated. The real difficulty isn't installation, but thinking through the layers: VPS security group, system firewall, NAT, and client routing.

If you just want a stable, lightweight, self-controlled VPN, WireGuard is well worth the effort.