Setting Up WireGuard VPN Server on Raspberry Pi

WireGuard is a fast, modern VPN. A Pi-hosted server lets you securely connect to your home network from anywhere.

Prerequisites

• Pi with static local IP (set in router DHCP)
• Dynamic DNS (DuckDNS) or static public IP
• Port forwarding: UDP 51820 on your router to the Pi

Install

sudo apt install wireguard -y

Generate Server Keys

cd /etc/wireguard
wg genkey | tee server_private.key | wg pubkey > server_public.key
chmod 600 server_private.key

Server Config /etc/wireguard/wg0.conf

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = [server_private.key contents]
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = [client_public.key]
AllowedIPs = 10.0.0.2/32

Enable IP forwarding:

echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Client Config

[Interface]
Address = 10.0.0.2/32
PrivateKey = [client_private.key]
DNS = 1.1.1.1

[Peer]
PublicKey = [server_public.key]
Endpoint = yourdomain.duckdns.org:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Start

sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

Import client config to WireGuard app on phone/laptop.