WireGuard VPN for Production: The Exact Setup I Deploy for Small Businesses

Description and use

Deploying WireGuard on a Debian 12 VPS or on‑prem server provides a fast, audited, and low‑maintenance VPN for small businesses, enabling full‑traffic or internal‑network routing with minimal configuration.

Problem

Small businesses need a secure, performant, and maintainable VPN solution that can be deployed quickly without complex certificate management or large attack surface.

Outcome

Deploying WireGuard on a Debian 12 VPS or on‑prem server provides a fast, audited, and low‑maintenance VPN for small businesses, enabling full‑traffic or internal‑network routing with minimal configuration.

Workflow

• 1. Prepare server: static IP, open UDP 51820, SSH access.
• 2. Install WireGuard on server: apt install wireguard.
• 3. Generate server key pair, set permissions, and create /etc/wireguard/wg0.conf with interface, address, listen port, PostUp/Down rules, and peer entry.
• 4. Enable IP forwarding: add net.ipv4.ip_forward = 1 to /etc/sysctl.conf and run sysctl -p.
• 5. Enable and start WireGuard: systemctl enable --now wg-quick@wg0.
• 6. On client: install WireGuard and openresolv.
• 7. Generate client key pair and create /etc/wireguard/wg0.conf with interface, address, DNS, and peer (server public key, endpoint, allowed IPs, keepalive).
• 8. Enable and start client: systemctl enable --now wg-quick@wg0.
• 9. Verify tunnel: wg show and ping 10.0.0.1.
• 10. Ensure systemd‑resolved DNS stub is correct and verify DNS via resolvectl status wg0.
• 11. Check for DNS leaks (truncated in source).

Evidence

WireGuard is the VPN I deploy for every small business I migrate to Linux.

Source

WireGuard is in the mainline Linux kernel since version 5.6, independently audited, and faster than OpenVPN on the same hardware.

Source

The entire trust model fits in a single config file. When something breaks, you can audit it in minutes.

Source