Set up your own WireGuard VPN server on Ubuntu 24.04

Protect your privacy and enjoy unthrottled high-speed connections with your own WireGuard server.

The right plan: Our entry-level plan Value S (€6.99/month) with a 1 Gbit/s uplink is enough for a private VPN with many clients.

1. Requirements

KVM server with Ubuntu 24.04 and root/sudo access
Docker installed (see our Docker tutorial)
UDP port 51820 open in your firewall (e.g. sudo ufw allow 51820/udp)

2. Start WG-Easy with Docker

This guide uses wg-easy version 15 (image tag 15.4.0, following the official docker run example). Connect to your server via SSH and first create the Docker network once:

docker network create \
  -d bridge --ipv6 \
  --subnet 10.42.42.0/24 \
  --subnet fdcc:ad94:bacf:61a3::/64 \
  wg

Then start the container. The web interface is deliberately bound to 127.0.0.1 only, so it is not reachable unencrypted from the internet:

docker run -d \
  --name wg-easy \
  --net wg \
  --ip 10.42.42.42 \
  --ip6 fdcc:ad94:bacf:61a3::2a \
  -e INSECURE=true \
  -v ~/.wg-easy:/etc/wireguard \
  -v /lib/modules:/lib/modules:ro \
  -p 51820:51820/udp \
  -p 127.0.0.1:51821:51821/tcp \
  --cap-add NET_ADMIN \
  --cap-add SYS_MODULE \
  --sysctl net.ipv4.ip_forward=1 \
  --sysctl net.ipv4.conf.all.src_valid_mark=1 \
  --sysctl net.ipv6.conf.all.disable_ipv6=0 \
  --sysctl net.ipv6.conf.all.forwarding=1 \
  --sysctl net.ipv6.conf.default.forwarding=1 \
  --restart unless-stopped \
  ghcr.io/wg-easy/wg-easy:15.4.0

Changed since version 15: The old variables WG_HOST and PASSWORD/PASSWORD_HASH from older guides no longer exist – you create the admin account and the server address in the setup wizard in the browser. Do not use the latest tag: according to the wg-easy docs it still points to the old version 14. INSECURE=true only allows HTTP access to the web interface – which here is only reachable through the SSH tunnel.

3. Open the web interface & complete the setup

On your local machine, open an SSH tunnel to the web interface and leave this terminal open:

ssh -L 51821:127.0.0.1:51821 benutzer@DEINE_SERVER_IP

Then open http://localhost:51821 in your browser. The setup wizard guides you through the first start:

Create an admin account with a username and a strong password.
When asked about an existing configuration, choose "No" for a new installation.
As Host, enter your server's public IP address (or a domain pointing to it), as Port 51820.

4. Connect a client

Create a new client in the web interface (e.g. "Phone" or "Laptop").
Scan the QR code directly with the official WireGuard app on your smartphone.
Or download the .conf file for your PC and import it into the WireGuard app.

1 Gbit/s high-speed VPN server

No logging, full bandwidth and your own KVM server – packages from €6.99/month.

Rent a VPN server now