Set up WireGuard on Ubuntu 24.04 for secure remote access

This example uses Ubuntu 24.04 as a VPN gateway: wg0 is 10.20.30.1/24, the client is 10.20.30.2, the remote LAN is 192.168.1.0/24, and WireGuard listens on UDP 51820. ens18 is the LAN-facing interface. Replace the addresses, interface and DNS for your network. A reachable public endpoint is required; if the server is behind NAT, forward UDP 51820 on its router.

Install and identify the interface

Install the packages and identify the actual interface toward the LAN. If you administer the server over SSH, check and permit its real port before enabling UFW; the later example assumes port 22.

sudo apt update
sudo apt install wireguard ufw
ip -br address

Generate server keys

Create the keys as root in /etc/wireguard with umask 077. The earlier instructions tried to enter a root-only directory from an unprivileged shell. Copy only server.pub to the client; never publish server.key or a full client configuration.

sudo install -d -m 700 /etc/wireguard
sudo sh -c 'umask 077; wg genkey > /etc/wireguard/server.key; wg pubkey < /etc/wireguard/server.key > /etc/wireguard/server.pub'
sudo cat /etc/wireguard/server.pub

Enable IPv4 forwarding

Write the first line shown to /etc/sysctl.d/99-wireguard-forward.conf, then run the next two commands. The final value should be 1. Forwarding alone does not add firewall rules or a return route.

net.ipv4.ip_forward=1
sudo sysctl --system
sysctl net.ipv4.ip_forward

Configure the server

Save this block as /etc/wireguard/wg0.conf. Replace SERVER_PRIVATE_KEY with the contents of server.key and CLIENT_PUBLIC_KEY with the public key generated on the client. The server should use AllowedIPs = 10.20.30.2/32; give each client a unique key and address. Do not add comments or whitespace to a key line.

[Interface]
Address = 10.20.30.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.20.30.2/32

UFW and LAN routing

Add the rules before enabling UFW. The route rule allows forwarding from the tunnel to the specified LAN. LAN hosts also need a return route for 10.20.30.0/24 via the Ubuntu server’s LAN address; add it to the LAN router. If that is impossible, consider a documented LAN-side NAT managed by the firewall; then hosts see the gateway IP rather than the client IP. Do not open unrestricted Internet forwarding.

sudo ufw allow OpenSSH
sudo ufw allow 51820/udp
sudo ufw route allow in on wg0 out on ens18 from 10.20.30.0/24 to 192.168.1.0/24
sudo ufw status verbose
sudo ufw enable

Generate client keys

Generate the pair in a private directory on a Linux client. Transfer only client1.pub to the server. On a phone, generate keys within the WireGuard app; a configuration QR code contains a private key and must be kept secret.

umask 077
wg genkey > client1.key
wg pubkey < client1.key > client1.pub

Configure the client

Import the block into the client app, replacing keys and endpoint. Its AllowedIPs make a split tunnel: only the VPN and remote LAN go through it. Set a LAN DNS server only if it exists and is reachable through the VPN. PersistentKeepalive = 25 is helpful behind NAT but optional for many peers.

[Interface]
PrivateKey = CLIENT_PRIVATE_KEY
Address = 10.20.30.2/24

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = vpn.example.net:51820
AllowedIPs = 10.20.30.0/24, 192.168.1.0/24
PersistentKeepalive = 25

Start and test

Protect wg0.conf, start the service, and inspect handshake and traffic counters with wg show. From the connected client, try 10.20.30.1 and then a permitted LAN host. With no handshake, check endpoint, UDP forwarding and keys. With a handshake but no LAN access, check IP forwarding, UFW, host firewalls and the return route. A blocked ping does not rule out a working application service.

sudo chmod 600 /etc/wireguard/wg0.conf
sudo systemctl enable --now wg-quick@wg0
sudo wg show
sudo ufw status numbered

More clients and references

Give each new peer a separate key and address, for example 10.20.30.3/32 on the server. Reload can add peers without recreating the interface; changes to Address, PostUp or wg-quick routes may require a restart. Official guides: https://documentation.ubuntu.com/server/how-to/wireguard-vpn/peer-to-site/index.html and https://documentation.ubuntu.com/server/how-to/wireguard-vpn/common-tasks/index.html .

sudo systemctl reload wg-quick@wg0