How to Set Up a WireGuard VPN on Your Own VPS (Ubuntu, Step by Step)

Run your own WireGuard VPN on a VPS in about ten minutes: install, keys, firewall and a QR code for your phone. Paid in crypto, billed by the hour.

Why run WireGuard on your own VPS

To set up a WireGuard VPN on a VPS you install one package, generate two key pairs, write a short config and open one UDP port. This guide takes you from an empty Ubuntu server to a working VPN on your phone and laptop in about ten minutes.

A VPN you run yourself has one user: you. You pick the country, you know who has root, and there is no shared pool of strangers behind the same IP. WireGuard is small, fast and built into the Linux kernel, so a 1 vCPU server handles a handful of personal devices without trouble.

Your own IP - the server has a dedicated IPv4 that nobody else shares.
Your own location - pick the country that fits, from 51 locations across six regions.
Low overhead - WireGuard uses one UDP port and very little CPU.
Full control - you decide what is logged, and by default nothing needs to be.

One honest caveat: a self-hosted VPN moves your traffic to a different IP, but the server still belongs to a hosting provider. It is not a replacement for good habits, and it does not make you anonymous on its own.

How to do it on Neckrez

Sign up - an email, or Google/GitHub. No KYC, no ID, no phone, no card.
Top up the balance in crypto - from $15. USDT on BEP20, TON, Polygon or Solana costs cents in fees; TRC20 costs a few dollars extra per top-up.
Pick plan, location and OS - Quark (1 vCPU, 1 GB, $10/month) is enough for personal use. Choose Ubuntu and the country you want to appear from.
Server ready in about a minute - with full root and a dedicated IPv4.
Billed hourly - a server is billed while it exists, even when stopped. Destroy it and billing stops.

There is also a WireGuard 1-click app on the deploy page if you want the finished result without the steps below. The manual route is worth doing once: you learn what every line does, and you can change it later. If you want the page built for this use, see VPS for VPN.

Install WireGuard and generate keys

sudo apt update
sudo apt install -y wireguard qrencode

Next, create a key pair for the server and one for your first device. The umask keeps the private keys readable only by root. The last command prints the name of your network interface; remember it, because the config below assumes eth0.

sudo -i
cd /etc/wireguard
umask 077
wg genkey | tee server.key | wg pubkey > server.pub
wg genkey | tee phone.key | wg pubkey > phone.pub
ip -o -4 route show to default | awk '{print $5}'

Write the server config and open the firewall

Create /etc/wireguard/wg0.conf with the content below. Replace the two placeholders with the real contents of server.key and phone.pub. If your interface is not eth0, change it in both PostUp and PostDown.

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <contents of server.key>
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = <contents of phone.pub>
AllowedIPs = 10.8.0.2/32

Now enable IP forwarding, allow SSH and the WireGuard port in the firewall, and start the tunnel. Allow SSH before you enable ufw, or you lock yourself out.

echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-wg.conf
sysctl --system
ufw allow OpenSSH
ufw allow 51820/udp
ufw enable
systemctl enable --now wg-quick@wg0
wg show

If wg show lists the wg0 interface, the server side is done. The tunnel starts again on every reboot because it is enabled in systemd.

Add your phone or laptop

Create /etc/wireguard/phone.conf with the client config below. Use the real server IP from your Neckrez dashboard. AllowedIPs = 0.0.0.0/0 sends all traffic through the VPN; narrow it if you only want to reach the server itself.

[Interface]
Address = 10.8.0.2/24
PrivateKey = <contents of phone.key>
DNS = 1.1.1.1

[Peer]
PublicKey = <contents of server.pub>
Endpoint = YOUR_SERVER_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Show it as a QR code in the terminal and scan it with the official WireGuard app. On a laptop, copy the file into the WireGuard app instead.

qrencode -t ansiutf8 < /etc/wireguard/phone.conf

Open the tunnel and check your public IP in a browser. It should now be the server's address. For a second device, repeat the key step, add another [Peer] block with AllowedIPs = 10.8.0.3/32 and give the device Address = 10.8.0.3/24.

Rule of thumb: one key pair per device, never shared. If a phone is lost, remove its [Peer] block and restart the tunnel; the other devices keep working.

Which Neckrez server line fits a personal VPN

A plain VPS is the right choice here. WireGuard needs little CPU, so the smallest plans are enough for one person or a family. Dedicated CPU, with cores reserved for you, only becomes the step up if you route heavy traffic for many users all day. Bare metal is far more than this job needs.

Two features help in practice. Every plan includes free anti-DDoS. On Vultr servers, the instant IP swap gives you a new IPv4 without rebuilding anything if an address ends up blocked; it costs one hour of the plan and works once per 24 hours per server. For a different region, deploy a second small server and pay by the hour. See also anonymous VPS.

FAQ

How much does a personal WireGuard VPN cost? The Quark plan is $10/month, billed hourly from your prepaid balance. The minimum top-up is $15.

Can I use it for more than one device? Yes. Add one [Peer] block per device with its own key and its own 10.8.0.x address.

Does the VPN keep working if the balance runs out? No. When the balance reaches zero, the disk is snapshotted, the server is deleted and the snapshot is kept for 7 days. Top up and restore it in one click.

Is there an uptime guarantee? No. Neckrez offers no uptime SLA and no downtime credits, so treat the VPN as a tool you can rebuild in ten minutes.

Get started

Plans from $10/month, billed hourly. Deploy a server now. Neckrez rents VPS, Dedicated CPU and bare metal servers, and GPU servers when the provider has capacity, all on one crypto balance billed by the hour.