Commercial VPN apps cost $60\u2013$120 a year, log more than they admit to, and share servers with thousands of strangers. A KVM-based VPS \u2014 the standard virtual-machine instance type sold by DigitalOcean, Linode, and Vultr \u2014 gives you a dedicated Linux box for about $4\u2013$6 a month, and WireGuard turns it into a VPN server in under fifteen minutes. This is the actual command-by-command setup, verified against DigitalOcean’s and Vultr’s current documentation.<\/p>\n\n\n\n\n\n\n\n
“KVM” (kernel-based virtual machine) is the virtualization type behind nearly every modern cloud VPS \u2014 it gives your instance its own kernel and full root access, unlike older container-based hosting (OpenVZ) that shares a kernel with other tenants and often blocks the networking modules WireGuard needs. Every droplet on DigitalOcean, every Linode instance, and every Vultr Cloud Compute instance is KVM, so any of the three works for this guide. Pick the cheapest plan with a public IPv4 address \u2014 1 CPU and 1GB RAM is overkill for a personal VPN.<\/p>\n\n\n\n
WireGuard was merged into the Linux kernel in version 5.6 (2020) and is now the default choice over OpenVPN because its codebase is roughly 4,000 lines versus OpenVPN’s 100,000+, it uses modern cryptography (Curve25519, ChaCha20, Poly1305, BLAKE2s) with no negotiated cipher suites to misconfigure, and it consistently benchmarks faster on mobile due to its UDP-only, stateless design.<\/p>\n\n\n\n
Create an Ubuntu 24.04 instance on any provider, note its public IP, and SSH in as root or a sudo user. WireGuard has shipped in Ubuntu’s default repositories since 18.04, so no PPA is required:<\/p>\n\n\n\n
sudo apt update\nsudo apt install wireguard qrencode -y\nwg --version<\/code><\/pre>\n\n\n\nqrencode<\/code> isn’t strictly part of WireGuard \u2014 it’s a small utility you’ll use later to turn your phone’s config into a scannable QR code.<\/p>\n\n\n\nStep 2: Generate the server’s key pair<\/h2>\n\n\n\n
WireGuard authenticates peers with public-key cryptography instead of usernames and passwords. Generate the server’s private and public keys, and lock down the private key’s permissions immediately:<\/p>\n\n\n\n
cd \/etc\/wireguard\numask 077\nwg genkey | tee server_private.key | wg pubkey > server_public.key<\/code><\/pre>\n\n\n\nRun cat server_private.key<\/code> and cat server_public.key<\/code> to view them \u2014 you’ll paste the private key into the server config next.<\/p>\n\n\n\nStep 3: Write the server configuration<\/h2>\n\n\n\n
First, identify your server’s default network interface \u2014 you’ll need its name for the NAT rule:<\/p>\n\n\n\n
ip -o -4 route show to default | awk '{print $5}'<\/code><\/pre>\n\n\n\nThis typically prints eth0<\/code> on DigitalOcean\/Linode or enp1s0<\/code> on Vultr. Create \/etc\/wireguard\/wg0.conf<\/code> with that interface name substituted in:<\/p>\n\n\n\n[Interface]\nAddress = 10.8.0.1\/24\nListenPort = 51820\nPrivateKey = <paste server_private.key here>\nPostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE\nPreDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE\n\n# Peers are appended below, one [Peer] block per device\n<\/code><\/pre>\n\n\n\n10.8.0.1\/24<\/code> is the VPN’s private subnet \u2014 the server is always the first address in it, and each client gets the next one (10.8.0.2, 10.8.0.3, and so on). Port 51820\/UDP is WireGuard’s conventional default; you can pick a different one, but it must match what clients connect to.<\/p>\n\n\n\nStep 4: Turn on IP forwarding<\/h2>\n\n\n\n
By default, Linux won’t route traffic between network interfaces \u2014 you have to explicitly enable it so the server can forward client traffic out to the internet:<\/p>\n\n\n\n
echo 'net.ipv4.ip_forward = 1' | sudo tee -a \/etc\/sysctl.conf\nsudo sysctl -p<\/code><\/pre>\n\n\n\nStep 5: Open the firewall<\/h2>\n\n\n\n
If you’re running UFW (Ubuntu’s default firewall), allow the WireGuard port before starting the service, or you’ll have a working tunnel that nothing can reach:<\/p>\n\n\n\n
sudo ufw allow 51820\/udp\nsudo ufw allow OpenSSH\nsudo ufw enable<\/code><\/pre>\n\n\n\nDigitalOcean and Linode leave the cloud-level firewall open by default (UFW is what’s actually blocking you); Vultr’s Cloud Firewall and DigitalOcean’s optional Cloud Firewall product are configured separately in their dashboards if you’ve enabled one \u2014 add a matching UDP 51820 rule there too.<\/p>\n\n\n\n
Step 6: Start WireGuard and enable it at boot<\/h2>\n\n\n\nsudo systemctl start wg-quick@wg0\nsudo systemctl enable wg-quick@wg0\nsudo systemctl status wg-quick@wg0\nsudo wg show wg0<\/code><\/pre>\n\n\n\nwg show wg0<\/code> should list your interface, its public key, and listening port with no peers yet. If systemctl status<\/code> shows “active (exited)” rather than “active (running),” that’s normal \u2014 wg-quick<\/code> is a one-shot script that configures the interface and then exits.<\/p>\n\n\n\nStep 7: Create a client and generate its QR code<\/h2>\n\n\n\n
Each device (phone, laptop) is its own “peer” with its own key pair. Generate one:<\/p>\n\n\n\n
cd \/etc\/wireguard\nwg genkey | tee client1_private.key | wg pubkey > client1_public.key<\/code><\/pre>\n\n\n\nAdd this peer to the bottom of \/etc\/wireguard\/wg0.conf<\/code> on the server:<\/p>\n\n\n\n[Peer]\nPublicKey = <paste client1_public.key here>\nAllowedIPs = 10.8.0.2\/32<\/code><\/pre>\n\n\n\nThen reload the config without dropping the tunnel:<\/p>\n\n\n\n
sudo wg syncconf wg0 <(wg-quick strip wg0)<\/code><\/pre>\n\n\n\nNow write the client’s own config file \u2014 this is the file the phone or laptop actually imports \u2014 as client1.conf<\/code>:<\/p>\n\n\n\n[Interface]\nPrivateKey = <paste client1_private.key here>\nAddress = 10.8.0.2\/24\nDNS = 1.1.1.1\n\n[Peer]\nPublicKey = <paste server_public.key here>\nEndpoint = <your server's public IP>:51820\nAllowedIPs = 0.0.0.0\/0\nPersistentKeepalive = 25<\/code><\/pre>\n\n\n\nAllowedIPs = 0.0.0.0\/0<\/code> routes all of the client’s traffic through the tunnel (a full VPN); set it to just 10.8.0.0\/24<\/code> instead if you only want access to the server’s private network, not full internet routing. PersistentKeepalive = 25<\/code> sends a keepalive packet every 25 seconds \u2014 necessary for phones, which otherwise drop the UDP mapping on cellular networks.<\/p>\n\n\n\nTurn that file into a QR code you can scan with the official WireGuard app (iOS\/Android) instead of typing it in by hand:<\/p>\n\n\n\n
qrencode -t ansiutf8 < client1.conf<\/code><\/pre>\n\n\n\nIn the WireGuard mobile app, tap the \"+\" button, choose \"Scan from QR code,\" and point the camera at the terminal. On desktop, copy client1.conf<\/code> to the machine running the official WireGuard client and import it directly \u2014 there's no QR step needed there.<\/p>\n\n\n\nTreat that QR code and .conf<\/code> file like a password: anyone who scans it gets full access to the tunnel. Delete client1.conf<\/code> from the server's disk once you've transferred it, since the private key doesn't need to live there.<\/p>\n\n\n\nVerify it actually works<\/h2>\n\n\n\n
Connect from the client, then from inside the tunnel check that your traffic is actually exiting through the VPS:<\/p>\n\n\n\n
ping -c 4 10.8.0.1\ncurl ifconfig.me<\/code><\/pre>\n\n\n\nThe ping should succeed, and curl ifconfig.me<\/code> should return your VPS's public IP, not your home or office IP. Back on the server, sudo wg show wg0<\/code> will now show the peer with a \"latest handshake\" timestamp and transfer counters \u2014 proof data is actually flowing.<\/p>\n\n\n\nRepeat Step 7 for every additional device, incrementing the IP each time (10.8.0.3, 10.8.0.4...). One $5\/month KVM instance comfortably handles a household's worth of phones and laptops, and because you control the box end to end, there's no provider logging your browsing to worry about \u2014 only your own.<\/p>\n\n","protected":false},"excerpt":{"rendered":"
Commercial VPN apps cost $60\u2013$120 a year, log more than they admit to, and share servers with thousands of strangers. A KVM-based VPS \u2014 the standard virtual-machine instance type sold by DigitalOcean, Linode, and Vultr \u2014 gives you a dedicated Linux box for about $4\u2013$6 a month, and WireGuard turns…<\/p>","protected":false},"author":0,"featured_media":2473,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4],"tags":[],"class_list":["post-2470","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-lifestyle"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/traroro.com\/wp-content\/uploads\/2026\/11\/vpn_kvm_featured.jpg","_links":{"self":[{"href":"https:\/\/traroro.com\/zh\/wp-json\/wp\/v2\/posts\/2470","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/traroro.com\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/traroro.com\/zh\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/traroro.com\/zh\/wp-json\/wp\/v2\/comments?post=2470"}],"version-history":[{"count":0,"href":"https:\/\/traroro.com\/zh\/wp-json\/wp\/v2\/posts\/2470\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/traroro.com\/zh\/wp-json\/wp\/v2\/media\/2473"}],"wp:attachment":[{"href":"https:\/\/traroro.com\/zh\/wp-json\/wp\/v2\/media?parent=2470"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/traroro.com\/zh\/wp-json\/wp\/v2\/categories?post=2470"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/traroro.com\/zh\/wp-json\/wp\/v2\/tags?post=2470"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}