Free tools Windows power users keep installed
One-click scans. No signup required.
To run WireGuard on an Ubuntu or Debian VPS, install the distribution package, create a key pair for the server and every client, assign a private tunnel subnet, configure wg0, enable IPv4 forwarding and NAT, open the same UDP port in both your VPS provider firewall and the host firewall, then start wg-quick@wg0. A successful handshake proves only that the encrypted tunnel is established; forwarding, masquerading, routes and DNS must also be correct before a client can reach other networks or the Internet.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
The procedure below uses a VPS as an IPv4 Internet gateway. It also shows how to change the routing for split tunneling, how to make the service survive reboots, and how to diagnose failures in layers without exposing private keys.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What you need before installing WireGuard
WireGuard is described by Canonical as “a simple, fast and modern VPN implementation.” It runs in the Linux kernel with the wg tool for low-level configuration and wg-quick for bringing an interface up with routes and hooks.
Prepare the following:
- A supported Ubuntu or Debian VPS with root or
sudoaccess. - A client device (Linux, Windows, macOS, Android or iOS) on which the official WireGuard client can be installed.
- The VPS public IPv4 address or a DNS name that resolves to it.
- Permission to edit the VPS provider’s security group or network firewall.
- A private tunnel subnet that does not overlap the VPS provider network, the client’s local LAN, or any remote site you intend to route.
You will need the VPS public-interface name for the NAT rule. Do not assume it is eth0; cloud images commonly use names such as ens3 or enp1s0.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
ip route show defaultThe output contains a line such as default via 203.0.113.1 dev ens3. In that example, ens3 is the external interface. You can also query the route selected for an Internet address:
ip route get 1.1.1.1Install the WireGuard packages
Ubuntu
sudo apt update
sudo apt install wireguardDebian
sudo apt update
sudo apt install wireguardThe distribution package supplies wg(8) and wg-quick(8). The official WireGuard installation guidance notes that kernel compatibility matters: use a supported release and its normal package repositories rather than copying binaries from an unrelated distribution.
Recommended Free Tools
Confirm that the commands are available:
wg --version
wg-quick --versionGenerate a separate key pair for every device
WireGuard authenticates peers with Curve25519 public-key cryptography. The server needs one private/public pair, and every client needs its own pair. Put only public keys in a peer’s configuration. A private key must remain on the device that owns it; never paste one into a ticket, chat, article, shell history or shared screenshot.
Server keys
sudo install -d -m 700 /etc/wireguard/keys
sudo sh -c 'umask 077; wg genkey > /etc/wireguard/keys/server_private.key'
sudo sh -c 'wg pubkey < /etc/wireguard/keys/server_private.key > /etc/wireguard/keys/server_public.key'
sudo chmod 600 /etc/wireguard/keys/server_private.key /etc/wireguard/keys/server_public.key
sudo cat /etc/wireguard/keys/server_public.keyRecord the displayed server public key. The private key will be read locally when you create wg0.conf; do not include its value in documentation or diagnostics.
Client keys
Generate the client pair on the client itself whenever possible. On a Linux client, the Debian-recommended pattern is:
umask 077
wg genkey | tee client_private.key | wg pubkey > client_public.key
cat client_public.keyFor a phone or desktop application, let the official WireGuard app generate the key pair. Copy the resulting public key to the server configuration and keep the private key in the client app’s protected storage.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Choose the tunnel address space and UDP port
The examples use 10.8.0.0/24, with the VPS at 10.8.0.1 and the first client at 10.8.0.2. Use another RFC1918 range if this overlaps a client LAN or a provider-internal network. Every client must have a unique address, normally represented by a host route such as 10.8.0.2/32 in the server’s peer section.
WireGuard can listen on any unused UDP port. UDP 51820 is a common choice, but it is not mandatory. Whichever port you select must be allowed in all of these places:
- The VPS provider’s security group, cloud firewall or edge ACL.
- The Linux host firewall.
- The client’s
Endpointvalue.
Opening TCP 51820 does not permit WireGuard traffic; the protocol in this setup is UDP.
Enable forwarding persistently on the VPS
A gateway must forward packets between wg0 and the public interface. A command run only in the current shell is lost after a reboot, so persist the setting:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo sh -c 'printf "net.ipv4.ip_forward = 1n" > /etc/sysctl.d/99-wireguard-forwarding.conf'
sudo sysctl --system
sysctl net.ipv4.ip_forwardThe last command should report net.ipv4.ip_forward = 1. IPv6 is separate. Do not advertise IPv6 default routes until you have deliberately enabled IPv6 forwarding, configured an IPv6 address plan, and installed matching firewall and return-route rules.
Create the server configuration
Create /etc/wireguard/wg0.conf with restrictive permissions:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
sudo install -m 600 /dev/null /etc/wireguard/wg0.conf
sudo editor /etc/wireguard/wg0.confReplace the uppercase values in the following template. The NAT commands assume the external interface discovered earlier is ens3; substitute your actual name.
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE
[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.8.0.2/32%i is expanded by wg-quick to the interface name, here wg0. The two FORWARD rules allow traffic entering from and leaving through the WireGuard interface. The POSTROUTING MASQUERADE rule rewrites packets leaving through the VPS’s public interface so Internet hosts can return traffic to the VPS.
The exact firewall syntax depends on whether the host uses nftables, iptables, UFW or firewalld. Do not blindly combine rule sets. If your distribution’s iptables command is an nftables compatibility layer, verify that the rules are accepted and persisted by the firewall system you actually operate. For production, place equivalent rules in that system’s persistent configuration instead of relying only on interface hooks.
Do not add a second peer with the same AllowedIPs. WireGuard uses those values to decide which peer owns a destination; overlapping entries can send packets to the wrong client.
Allow the port in provider and host firewalls
In the VPS control panel, add an inbound rule for UDP 51820 from the client networks you trust. Using 0.0.0.0/0 permits clients from anywhere on the Internet to send packets to the port; the cryptographic key still controls peer authentication, but narrowing the source range can reduce unsolicited traffic.
On the VPS, allow the same UDP port through the active host firewall. The command differs by implementation:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
- UFW: add a UDP rule for 51820, then ensure forwarding and the MASQUERADE policy are represented in UFW’s persistent configuration.
- firewalld: open UDP 51820 in the appropriate zone and add a trusted forwarding/NAT policy.
- nftables: add the UDP input, forward and postrouting rules to the ruleset loaded at boot.
- iptables: add the input, FORWARD and POSTROUTING rules and save them using the persistence mechanism installed for your distribution.
Also check outbound or egress restrictions in the provider firewall. A VPS can receive a handshake while provider policy still blocks forwarded Internet traffic.
Build the client configuration
A client configuration contains its own address and private key plus a peer section for the server:
[Interface]
Address = 10.8.0.2/24
PrivateKey = CLIENT_PRIVATE_KEY
DNS = TRUSTED_DNS_SERVER
[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = VPS_PUBLIC_IP_OR_HOSTNAME:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25Set DNS to a resolver you trust and that is reachable through the selected routing policy. The exact resolver address is a local policy choice; if you omit the field, the client keeps its existing DNS configuration.
Full-tunnel routing
AllowedIPs = 0.0.0.0/0 sends all IPv4 destinations through the VPS. wg-quick installs policy-routing rules and a temporary route arrangement so the encrypted endpoint remains reachable outside the tunnel. The client therefore uses the VPS as its IPv4 Internet gateway, and the server must have forwarding, FORWARD rules and MASQUERADE working.
Split-tunnel routing
For a VPN used only to reach private resources, list those networks instead of the default route:
AllowedIPs = 10.8.0.0/24, 192.168.50.0/24In this example, traffic to the WireGuard subnet and the remote 192.168.50.0/24 network uses the tunnel; ordinary web traffic keeps its local route. The remote network must have a return route to 10.8.0.0/24, or the gateway must perform NAT for it.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
IPv6 considerations
Adding ::/0 creates an IPv6 full tunnel, but only when the VPS has usable IPv6 connectivity and you have configured IPv6 forwarding, firewall rules and return routing. An IPv4-only setup should leave IPv6 routes out rather than creating a black hole for IPv6 traffic.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhy use PersistentKeepalive
PersistentKeepalive = 25 sends a periodic authenticated packet so a client behind a stateful NAT keeps its mapping. It is useful for roaming laptops and phones, but it is not a substitute for opening the VPS’s UDP port or fixing a firewall rule.
Start WireGuard and enable it at boot
Bring up the interface manually while testing:
sudo wg-quick up wg0
sudo wg show
ip addr show wg0To stop it during a configuration change:
sudo wg-quick down wg0Once the configuration works, let systemd start it after every reboot:
sudo systemctl enable --now wg-quick@wg0
sudo systemctl status wg-quick@wg0Useful lifecycle commands are:
sudo systemctl restart wg-quick@wg0
sudo systemctl reload wg-quick@wg0
sudo journalctl -u wg-quick@wg0 -bRun reload when you want systemd to re-read a changed configuration without taking the interface fully down, and use restart when route or hook changes require a complete cycle.
Test the tunnel in the order packets travel
Testing one layer at a time prevents a working handshake from being mistaken for a working gateway.
- Check the handshake. On the VPS, run
sudo wg show. The client peer should have a recent “latest handshake” timestamp and transfer counters that increase when you generate traffic. - Ping the tunnel endpoint. From the client, ping
10.8.0.1. Failure here points to keys, addresses, the endpoint, UDP reachability or a local firewall. - Test a routed private host. If this is a site-to-site design, ping or connect to a host in the advertised private subnet. Verify that host’s return route to the WireGuard network.
- Test an external IP. With a full tunnel, query an address such as
1.1.1.1. If the handshake and tunnel ping work but this fails, inspect forwarding, the FORWARD chain, MASQUERADE interface and provider egress rules. - Test DNS last. Resolve a hostname only after raw IP traffic works. A successful IP test with failed names indicates the client’s DNS setting or a resolver policy problem, not WireGuard encryption.
Ubuntu’s site-to-site guidance emphasizes testing hosts beyond the WireGuard endpoint. A ping to 10.8.0.1 confirms only the first hop; it does not prove that forwarding and return paths are correct.
Troubleshoot the common failure modes
No handshake appears
- Confirm the client
Endpointuses the VPS’s current public address and the selected UDP port. - Check that the provider firewall and host firewall both allow UDP, not TCP.
- Verify that the server and client public keys are not swapped and that each private key belongs to the corresponding public key.
- Check the VPS clock and the client’s network. Severe clock errors can prevent authenticated packets from being accepted.
- Inspect
sudo journalctl -u wg-quick@wg0 -bfor syntax or hook failures.
Handshake works, but the client cannot ping 10.8.0.1
- Confirm the server has
Address = 10.8.0.1/24and the client has a different address such as10.8.0.2/24. - Check local operating-system firewalls on both endpoints.
- Make sure the server peer’s
AllowedIPsis the client’s unique tunnel address,10.8.0.2/32.
Tunnel ping works, but Internet access fails
- Run
sysctl net.ipv4.ip_forward; it must return1. - Check that the FORWARD policy permits traffic in both directions.
- Verify that MASQUERADE names the actual public interface, not a guessed
eth0. - Confirm that the client uses
AllowedIPs = 0.0.0.0/0for a full IPv4 tunnel. - Look for provider-level egress restrictions and ensure return traffic is not blocked.
IP traffic works, but names do not resolve
Review the client’s DNS entry and whether that resolver is reachable through the tunnel. If you use split tunneling, ensure the resolver’s network is included in AllowedIPs or intentionally remains on the local network.
The service fails after reboot
- Check
systemctl is-enabled wg-quick@wg0. - Read the boot log with
journalctl -u wg-quick@wg0 -b. - Confirm that key and configuration files still have the expected ownership and mode 0600.
- Verify that the firewall rules and IPv4 forwarding setting are loaded by their persistent systems, not only by a previous interactive command.
Onboard a phone with a QR code
You can render a client configuration for import into the official mobile WireGuard app with qrencode. Install it on the administration machine, not necessarily on the VPS:
sudo apt install qrencode
qrencode -t ansiutf8 < client.confThe QR image contains the client’s private key and is therefore equivalent to handing someone the configuration file. Display it only to the intended user, do not post it in a shared channel, and delete temporary image files after import. If you suspect exposure, revoke that peer by removing its public key from the server configuration and issue a new client key pair.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Choose the right deployment pattern
| Decision | Option | What changes |
|---|---|---|
| Routing scope | Split tunnel | Only listed private networks use WireGuard; local Internet access remains local. |
| Routing scope | Full IPv4 tunnel | 0.0.0.0/0 sends all IPv4 traffic through the VPS and requires forwarding plus NAT. |
| Topology | Road-warrior | Individual laptops or phones connect to one VPS peer entry each. |
| Topology | Site-to-site | Gateways advertise LAN prefixes and require return routes or deliberate NAT. |
| Firewall | iptables, nftables, UFW or firewalld | Use one system’s persistent syntax for input, forwarding and postrouting; commands are not interchangeable. |
| Addressing | IPv4 only | Use the demonstrated subnet and default route without advertising IPv6. |
| Addressing | Dual stack | Add IPv6 addresses and routes only with matching forwarding, firewall and return-route design. |
| Operations | Manual | Run wg-quick up/down when needed; suitable for initial testing. |
| Operations | Persistent | Use systemctl enable --now wg-quick@wg0 and monitor its journal. |
| Onboarding | Configuration file | Transfer the file through a private channel and protect it as a credential. |
| Onboarding | QR import | Convenient for mobile devices, but the QR image contains the client’s private key. |
Security and maintenance checklist
- Keep
/etc/wireguard/wg0.confand private-key files mode 0600, readable only by root or the owning client account. - Give each client a distinct key pair and tunnel address so one device can be revoked without replacing every peer.
- Record which public key belongs to each device; public keys are not secret, but accurate inventory prevents accidental peer removal.
- Restrict provider and host firewall exposure to the UDP port and administrative sources you actually need.
- Review transfer counters and recent handshakes when investigating unexpected access.
- When a device is lost, remove its peer entry, reload or restart
wg-quick@wg0, and generate a replacement pair. - Back up the configuration securely, never alongside unencrypted private keys in a publicly readable repository.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
