How do I set up WireGuard on a VPS?

Install wireguard, generate a server keypair, write /etc/wireguard/wg0.conf with the server key, a peer block for each device, and a NAT PostUp rule, enable IP forwarding, then wg-quick up wg0. Add each client's public key as a peer. The full config is below. You need a dedicated-IP plan because WireGuard listens on an inbound UDP port.

Do I need a dedicated IP for WireGuard?

Yes. WireGuard listens on a UDP port (51820 by default) that clients connect to, and NAT plans don't forward arbitrary inbound ports. A Nano-IP ($8/mo) with its own public IPv4 is enough for a personal VPN.

Is my own WireGuard more private than a commercial VPN?

Different, not strictly better. You control the server and nobody logs you but you — but your exit IP is yours alone, so you don't blend into a crowd like on a shared commercial VPN. Good for a clean, fast connection you fully control; not the tool if your goal is to be indistinguishable from strangers.

Does WireGuard work where VPNs are blocked (Iran/China/Russia)?

Often no — deep packet inspection fingerprints WireGuard's handshake and blocks it. If you're behind DPI you need a protocol that looks like normal HTTPS; see the VLESS + Reality guide instead. WireGuard is ideal on networks that don't actively hunt VPNs.

Do you ask for ID or a card?

No. Email to sign up, pay in USDC or USDT — fitting for a privacy tool. No documents, no card.

How to set up a WireGuard VPN on a VPS

Set up your own WireGuard VPN on a VPS: install WireGuard, generate server and client keys, write wg0.conf with NAT, enable IP forwarding, and connect a device. Copy-paste config for a personal VPN you control.

A personal WireGuard VPN is the server, keys, and logs all yours. This is the manual config how-to; for the trade-offs vs commercial VPNs, the one-command wg-easy path, and the DPI caveat, see self-host WireGuard and the VPS for VPN use-case. You need a dedicated-IP plan — WireGuard listens on an inbound UDP port.

1. Install WireGuard and make server keys

apt update && apt install -y wireguard
wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub
chmod 600 /etc/wireguard/server.key

2. Write the server config

# /etc/wireguard/wg0.conf
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <contents of /etc/wireguard/server.key>
PostUp   = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]                       # your phone/laptop
PublicKey = <client public key — see step 4>
AllowedIPs = 10.8.0.2/32

3. Enable forwarding and start it

sysctl -w net.ipv4.ip_forward=1
echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.conf
ufw allow 51820/udp
systemctl enable --now wg-quick@wg0
wg show

4. Generate a client key and connect

On the client (or generate on the server and move it):

wg genkey | tee client.key | wg pubkey > client.pub

Put client.pub into the [Peer] block above (then systemctl restart wg-quick@wg0), and give the client this config:

[Interface]
PrivateKey = <client.key>
Address = 10.8.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = <server.pub>
Endpoint = YOUR.SERVER.IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Import it into the WireGuard app (a QR via qrencode -t ansiutf8 < client.conf is quickest on mobile), toggle on, and you're routing through your own server.

Notes

Behind DPI (Iran/China/Russia)? WireGuard gets fingerprinted and blocked — use VLESS + Reality instead.
Prefer a web UI? The wg-easy one-command path sets this up with a QR-code admin panel.

Nano-IP ($8/mo) is plenty, unmetered traffic, root in about a minute, no KYC, pay in crypto.