Setting up a WireGuard VPN: secure access to your own server

Description and use

Set up a WireGuard VPN to securely access internal server services without opening extra ports.

Problem

Publicly exposed services on a server should remain private; accessing internal services like dashboards or databases requires a secure tunnel without opening additional ports.

Outcome

A lightweight, kernel‑level VPN is established, providing encrypted access to internal services without exposing additional ports. Split or full tunnel modes are configurable via a single client line.

Workflow

• Install WireGuard tools and qrencode
• Generate server and client key pairs
• Create /etc/wireguard/wg0.conf with server private key and client public key
• Open UDP port 51820 in UFW (and netcup firewall if used)
• Start and enable wg-quick@wg0
• Create client.conf with client private key, server public key, endpoint, AllowedIPs, PersistentKeepalive
• Generate QR code for phone or import config on desktop
• Delete client key files from server
• Activate tunnel on client and verify handshake and traffic
• Optional: change client AllowedIPs to 0.0.0.0/0 and set DNS for full tunnel

Evidence

WireGuard runs in the kernel, is tiny with only a few thousand lines of code (easy to audit, small attack surface)

Source

The client config is the mirror image. Create a file client.conf (on the server to generate the QR code; you then transfer the content to the client device)

Source