Set Up a WireGuard VPN with wg-easy v15 on Your Own VPS

With your own VPS you run the VPN server yourself and decide what it logs.

You need a VPS (virtual private server, a virtual server in a data center) with a public IP address or domain (wg-easy docs, as of Nov 8, 2026). Current plans and prices incl. VAT are in the VPS comparison.

Why run your own VPN?

Your own VPN works well for: secure access to your home network, encrypted traffic on public Wi-Fi, and access to self-hosted services like Immich or Paperless.

The difference from a commercial VPN service: you run the server, apply the updates and decide on logs and location. You'll find a comparison further down in the section "WireGuard vs. commercial VPNs".

Prerequisites

You need:

• A VPS with root access, x86_64 or arm64, and a public IP address or domain (wg-easy docs, as of Nov 8, 2026). The docs give no figure for RAM or CPU. Compare VPS offers →
• An Ubuntu version supported by Docker, such as 22.04, 24.04 or 26.04 LTS (Docker docs, as of Nov 8, 2026)
• Docker with Docker Compose
• For access to the web UI over the internet: a domain pointing to the server

Traffic: Check the included traffic in the plan and what happens after that, extra charges or throttling, on the provider's website. You'll find plans and locations on the provider pages for Hetzner, Netcup and IONOS; prices are shown there live.

Step 1: Install Docker (if needed)

Install Docker from the apt repository as the Docker docs describe for Ubuntu; per Docker, the convenience script is not meant for production systems (Docker docs, as of Nov 8, 2026).

If you add your user to the docker group, it gets root-level privileges (Docker docs, as of Nov 8, 2026). Without that step you run Docker with sudo.

Step 2: Install wg-easy

wg-easy is a web UI for WireGuard: create clients, show a QR code, download the configuration. The project is licensed under AGPL-3.0 (wg-easy README, as of Nov 8, 2026).

The installation follows the official guide: download the project's Compose file and start it (wg-easy docs, as of Nov 8, 2026):

mkdir -p ~/wg-easy && cd ~/wg-easy
curl -o docker-compose.yml https://raw.githubusercontent.com/wg-easy/wg-easy/master/docker-compose.yml
# before the first start: bind the web UI locally only (see step 3)
sed -i 's|"51821:51821/tcp"|"127.0.0.1:51821:51821/tcp"|' docker-compose.yml
sudo docker compose up -d

The Compose file uses the image ghcr.io/wg-easy/wg-easy:15, grants NET_ADMIN and SYS_MODULE, mounts /lib/modules read-only and sets IP forwarding as sysctls in the container (wg-easy Compose file, as of Nov 8, 2026).

Important:

• Use the tag 15, not latest: per the project, latest still points to v14 and should be avoided (wg-easy docs, as of Nov 8, 2026).
• v15 is a rewrite. It does not take over v14 environment variables such as WG_HOST, PASSWORD or WG_DEFAULT_DNS; settings now live mostly in the admin panel (wg-easy docs, as of Nov 8, 2026).
• Port 51820/UDP is the WireGuard port and must be open in the firewall; port 51821/TCP belongs to the web UI (wg-easy docs, as of Nov 8, 2026).

Step 3: Configure the firewall

Allow SSH first, otherwise ufw enable can cut your current connection (Ubuntu docs, as of Nov 8, 2026):

sudo ufw allow OpenSSH
sudo ufw allow 51820/udp  # WireGuard
sudo ufw enable

If your host also has a cloud firewall, 51820/udp must be open there too. If the reverse proxy runs directly on the host, also allow 80/tcp and 443 in ufw.

Note: Ports published by Docker bypass ufw (Docker docs, as of Nov 8, 2026). A ufw rule for port 51821 therefore does not protect the web UI. That's why step 2 binds the port to 127.0.0.1:51821:51821/tcp before the first start; then only the server itself can reach it (Docker docs, as of Nov 8, 2026).

Step 4: Set up the web UI

wg-easy v15 refuses HTTP unless INSECURE is set to true (wg-easy docs, as of Nov 8, 2026). Without a reverse proxy the docs call the setup insecure; the web UI should then not be reachable from outside the local network (wg-easy docs, as of Nov 8, 2026).

For access over the internet you therefore set up a reverse proxy with HTTPS and your own domain, for example Caddy with ports 80/tcp, 443/tcp and 443/udp (wg-easy docs, as of Nov 8, 2026).

On first access the setup wizard walks you through username, password, host (public IP or domain) and port (wg-easy docs, as of Nov 8, 2026).

Step 5: Create your first client

Create a client in the web UI and give it a name, for example "Phone" or "Laptop". wg-easy then shows a QR code and offers the configuration for download (wg-easy README, as of Nov 8, 2026).

If you want AdGuard Home as an ad blocker ("Optional" section below), set it up before the first client. Each device gets its own client. That way you can block a lost phone on its own without setting up the other devices again.

Step 6: Set up a mobile client (iOS/Android)

Via QR code:

1. Install the WireGuard app from the App Store or Play Store (WireGuard site, as of Nov 8, 2026)
2. Add a tunnel from a QR code in the app
3. Scan the QR code in wg-easy
4. Activate the tunnel

Step 7: Set up a desktop client

Windows/macOS

1. Install the Windows or macOS app (WireGuard site, as of Nov 8, 2026)
2. Download the client's .conf file in wg-easy
3. Import the file as a tunnel in the WireGuard app
4. Connect

Linux

Install your distribution's WireGuard package (WireGuard site, as of Nov 8, 2026). wg-quick reads the configuration from /etc/wireguard/INTERFACE.conf (wg-quick man page, as of Nov 8, 2026):

# Copy the config file to /etc/wireguard/wg0.conf, then:
sudo wg-quick up wg0

Step 8: Check the connection

With the tunnel active, open a page that shows your public IP address. It should show your VPS's IP, not your home connection's.

If it still shows your own IP, check whether the client sends all traffic through the tunnel (see "Split tunneling" below).

Optional: Ad blocker in the VPN

For an ad blocker in the VPN there is an official guide with AdGuard Home. It resets WireGuard, and existing clients are deleted (wg-easy docs, as of Nov 8, 2026). So set this up before your first client.

In v15 you set the DNS server per client (wg-easy docs, as of Nov 8, 2026) or via INIT_DNS during unattended setup (wg-easy docs, as of Nov 8, 2026).

Common problems

Client won't connect

• Is port 51820/UDP open in ufw and in your host's cloud firewall?
• Is the public IP or domain set as host (setup wizard or admin panel)?
• Behind NAT, for example on mobile networks, PersistentKeepalive keeps the connection open, for example at 25 seconds (WireGuard site, as of Nov 8, 2026); in wg-easy you set the value per client (wg-easy docs, as of Nov 8, 2026).

Connected, but no internet

• wg-easy sets the required POSTROUTING rules itself. If startup logs report missing nat or filter tables, load the kernel modules, e.g. with modprobe iptable_nat (wg-easy docs, as of Nov 8, 2026).
• DNS problem: set a different DNS server in the client configuration.

Slow connection

• Is your VPS's network link sufficient? The port speed is listed in the plan.
• MTU: wg-quick determines it automatically (wg-quick man page, as of Nov 8, 2026); in wg-easy you can adjust it per client (wg-easy docs, as of Nov 8, 2026).

Web UI not reachable

• Accessing via HTTP? Then INSECURE=true must be set; otherwise go through the reverse proxy with HTTPS (wg-easy docs, as of Nov 8, 2026).
• Container running? docker ps
• Check logs: docker logs wg-easy

Advanced: Split tunneling & multi-server

Split tunneling

Route only some traffic through the VPN: in the client's Allowed IPs, enter specific IPs or networks instead of 0.0.0.0/0 and ::/0 (wg-easy docs, as of Nov 8, 2026). With 0.0.0.0/0 or ::/0, wg-quick sets the default route through the tunnel (wg-quick man page, as of Nov 8, 2026).

VPN for the whole home network

Some routers can act as a WireGuard client themselves, for example pfSense via an add-on package (Netgate docs, as of Nov 8, 2026). Whether and how your router can do this is in its docs.

Multi-server setup

Several VPS locations: wg-easy runs separately on each server, and each client gets its own configuration per server.

Security tips

• Don't expose the web UI directly to the internet: bind the port to 127.0.0.1 or publish it only through the reverse proxy (Docker docs, as of Nov 8, 2026)
• Long password used only here and two-factor login via TOTP (wg-easy docs, as of Nov 8, 2026)
• SSH with keys only, no password login
• Security updates: unattended-upgrades is preinstalled on Ubuntu Server and applies security updates daily (Ubuntu docs, as of Nov 8, 2026)

WireGuard itself uses Curve25519, ChaCha20 with Poly1305, BLAKE2s, SipHash24 and HKDF (WireGuard site, as of Nov 8, 2026) and is designed to be fully reviewable by individuals (WireGuard site, as of Nov 8, 2026).

WireGuard vs. commercial VPNs

A self-hosted WireGuard VPN serves a different purpose than commercial VPN services. Both have their place, depending on what you want to achieve.

For access to your home network and your self-hosted services, your own server is enough. If you already use the VPS for other services, no extra server is needed.

Traffic & bandwidth: what to look for in a VPS

VPN traffic passes through your VPS in both directions. Whether incoming, outgoing or both count is in the provider's plan. Look at two values:

• Included traffic: Check the included volume and the rules for exceeding it on the provider's website.
• Network link: Check the port speed in the plan.

A location close to your home connection can mean shorter routes. The locations per provider are on the provider pages for Hetzner, IONOS and Netcup.

Conclusion

You now run your own WireGuard VPN on your server.

The same VPS can also run Vaultwarden as a password manager, Immich for photos or Ollama for AI chats.

More Self-Hosting Guides

Vaultwarden Setup

Bitwarden auf eigenem Server

Lesen

Immich Self-Hosting Guide

Google Photos Alternative

Lesen

n8n Self-Hosting Guide

Docker Setup Schritt für Schritt

Lesen