Setting up a WireGuard VPN: secure access to your own server

说明与用途

设置 WireGuard VPN，以安全方式访问服务器内部服务，无需打开额外端口。

问题

Publicly exposed services on a server should remain private; accessing internal services like dashboards or databases requires a secure tunnel without opening additional ports.

结果

A lightweight, kernel‑level VPN is established, providing encrypted access to internal services without exposing additional ports. Split or full tunnel modes are configurable via a single client line.

工作流

• Install WireGuard tools and qrencode
• Generate server and client key pairs
• Create /etc/wireguard/wg0.conf with server private key and client public key
• Open UDP port 51820 in UFW (and netcup firewall if used)
• Start and enable wg-quick@wg0
• Create client.conf with client private key, server public key, endpoint, AllowedIPs, PersistentKeepalive
• Generate QR code for phone or import config on desktop
• Delete client key files from server
• Activate tunnel on client and verify handshake and traffic
• Optional: change client AllowedIPs to 0.0.0.0/0 and set DNS for full tunnel

证据

WireGuard runs in the kernel, is tiny with only a few thousand lines of code (easy to audit, small attack surface)

来源

The client config is the mirror image. Create a file client.conf (on the server to generate the QR code; you then transfer the content to the client device)

来源