WireGuard VPN Setup

07/08/2024

This short but useful guide will help you get up and running WireGuard VPN on your server, essentially allowing you to access your server and home network remotely and securely.

What is WireGuard?

WireGuard is a modern, high-performance VPN protocol designed to be simple and secure. It creates a private, encrypted tunnel between devices over the internet, ensuring that data remains confidential and secure. Unlike traditional VPNs, WireGuard aims for ease of use and efficient performance with minimal overhead, making it a popular choice for both personal and professional use. Its streamlined codebase and fast speeds offer a compelling solution for secure remote access and network privacy.

Installation (Server)

Before proceeding, make sure to hash your desired password by running the below command:

docker run -it ghcr.io/wg-easy/wg-easy wgpw YOUR_PASSWORD

The output will be a bcrypt hash like: "$2y$10$hBCoykrB95WSzuV4fafBzOHWKu9sbyVa34GJr8VV5R/pIelfEMYyG"

Since we will be using docker-compose, anywhere you have the "$" symbol, make sure to add an extra one, so "$$" and copy the hash.

Now, we can proceed with the rest:

Create and open the directory
```
mkdir wireguard && cd wireguard
```
Create a docker file
```
nano docker-compose.yml
```

Paste the below and replace "your_hash" with the hash you've made in the previous steps:

version: "3.8"
volumes:
  etc_wireguard:

services:
  wg-easy:
    environment:
      # Change Language:
      # (Supports: en, ua, ru, tr, no, pl, fr, de, ca, es, ko, vi, nl, is, pt, chs, cht, it, th, hi)
      - LANG=en
      # Required:
      # Change this to your host's public address
      - WG_HOST=IP #e.g. 78.80.80.66

      # Optional:
      - PASSWORD_HASH=your_hash
      # - WG_PORT=51820
      # - WG_DEFAULT_ADDRESS=10.8.0.0
      # - WG_DEFAULT_ADDRESS_RANGE=24
      # - WG_DEFAULT_DNS=1.1.1.1
      # - WG_MTU=1420
      - WG_ALLOWED_IPS=0.0.0.0/0, ::/0
      # - WG_PERSISTENT_KEEPALIVE=25
      # - WG_PRE_UP=echo "Pre Up" > /etc/wireguard/pre-up.txt
      # - WG_POST_UP=echo "Post Up" > /etc/wireguard/post-up.txt
      # - WG_PRE_DOWN=echo "Pre Down" > /etc/wireguard/pre-down.txt
      # - WG_POST_DOWN=echo "Post Down" > /etc/wireguard/post-down.txt
      # - UI_TRAFFIC_STATS=true
      # - UI_CHART_TYPE=0 (0 # Charts disabled, 1 # Line chart, 2 # Area chart, 3 # Bar chart)

    image: ghcr.io/wg-easy/wg-easy
    container_name: wg-easy
    volumes:
      - etc_wireguard:/etc/wireguard
    ports:
      - "51820:51820/udp"
      - "51821:51821/tcp"
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1

Save with CTRL+X, Y, Enter
Delpoy the container
```
docker-compose up -d
```
Confirm that it deployed successfully
```
docker ps
```
Port Forward port 51820 (UDP) to the host's local IP from the router settings

Installation (Client)

Download the WireGuard from AppStore/GooglePlay
Navigate to localhost:51821, add user, and generate QR code
Scan the QR code with the client device
Ensure the Endpoint is set to PublicIP:51820

Firewall Port configuration

If you do have a firewall in place, make sure that you've properly allowed the requried ports in the firewall. In case you need assistance with this - check my guide for UFW here.