Set Up Your Own WireGuard VPN on a VPS (Step by Step)

Short answer: rent the smallest Linux VPS ($3.90 a month) in the country your traffic should come from, install WireGuard, and give each phone or laptop its own key. The whole setup takes about 15 minutes on Ubuntu 24.04 or Debian 12, and the server handles several devices at full speed.

A commercial VPN shares one IP with thousands of strangers and keeps whatever logs its policy allows. Your own server is yours alone: you hold the keys, nobody else's traffic shares your IP, and you can run other things on it. The page about your own VPN has the short version; this is the full walkthrough.

01What You Need

• A Linux VPS: the $3.90 plan (1 vCPU, 1 GB RAM) is enough for a few devices
• SSH access as root (the details are on your server page)
• The WireGuard app on each device: Windows, macOS, iOS, Android and Linux all have one

Pick the location by where your traffic should appear to come from: Amsterdam, Frankfurt, Warsaw, Romania, New York or Hong Kong.

021. Install WireGuard and Make Keys

apt update && apt install -y wireguard qrencode
cd /etc/wireguard
umask 077
wg genkey | tee server.key | wg pubkey > server.pub
wg genkey | tee phone.key  | wg pubkey > phone.pub

Every device gets its own key pair. umask 077 keeps the private keys readable by root only.

032. Find the Network Interface

ip route show default

The word after dev is your public interface, often eth0 or ens3. You need it for the NAT rule below.

043. Write the Server Config

Create /etc/wireguard/wg0.conf (replace eth0 if yours differs, and paste the keys from the files):

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <contents of server.key>
PostUp = iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

[Peer]
# phone
PublicKey = <contents of phone.pub>
AllowedIPs = 10.8.0.2/32

The PostUp line sends your devices' traffic out through the server's public IP.

054. Turn On Forwarding and Start It

echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/99-wireguard.conf
sysctl --system
systemctl enable --now wg-quick@wg0
wg show

wg show lists the interface and the peer. If you use the firewall on your server page, allow UDP 51820 in it.

065. Connect Your Phone

Create phone.conf on the server:

[Interface]
PrivateKey = <contents of phone.key>
Address = 10.8.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = <contents of server.pub>
Endpoint = <your server IP>:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Show it as a QR code and scan it in the WireGuard app (Add tunnel → Scan from QR code):

qrencode -t ansiutf8 < phone.conf

Switch the tunnel on and check your IP on any "what is my IP" site: it should show the server's address.

07Add More Devices

1. 1New key pair: wg genkey | tee laptop.key | wg pubkey > laptop.pub
2. 2New [Peer] block in wg0.conf with laptop.pub and the next address, 10.8.0.3/32.
3. 3Reload: systemctl restart wg-quick@wg0
4. 4Client config like the phone's, with Address = 10.8.0.3/32 and the laptop's private key.

08What Your Own VPN Does and Doesn't Do

Your own VPN is private. It isn't anonymous.

• It does encrypt everything between your device and the server, hide your browsing from the Wi-Fi or mobile network you're on, and give you an IP in the country you chose.
• It doesn't hide you from the sites you visit if you log in, and the server's IP is tied to your server account. On Rdp.Vision that account is just an email or Telegram, paid with crypto, which keeps your name out of it.
• Logs are your call. WireGuard itself keeps no connection logs; we don't log in to your server or install anything on it.

The usual rules still apply: no spam, attacks or anything illegal through the server. Outgoing mail on port 25 is blocked on every server.