What is WireGuard VPN ?
WireGuard is a secure network tunnel operating at Layer 3, built directly into the Linux kernel as a virtual network interface. Its goal is straightforward: replace both IPsec and TLS-based solutions such as OpenVPN — and do it better. More secure, more performant, and significantly easier to use.
A cleaner mental model
At its core, WireGuard is built around a simple principle: a tunnel is an association between a peer's public key and a tunnel source IP. No certificates, no certificate authorities, no complex configuration hierarchies. If you've used OpenSSH, the model will feel familiar — short, static Curve25519 keys handle mutual authentication, and that's it. No central server required. it's peer-to-peer by design, though you can use a hub-and-spoke topology.
Fast handshakes, strong privacy
Session creation is handled transparently using a single round-trip key exchange based on the NoiseIK protocol — fast and invisible to the end user. The protocol provides strong perfect forward secrecy and a high degree of identity hiding, so even if keys are later compromised, past sessions stay protected.
Performance-first design
Data in transit is encrypted using ChaCha20Poly1305, a modern authenticated-encryption cipher that's fast even on hardware without dedicated AES acceleration. Packets are encapsulated in UDP, and the kernel-level implementation takes full advantage of Linux's queue and parallelism primitives. Crucially, WireGuard is designed to allocate no resources in response to incoming packets — a key factor in its resilience under load. So, it runs over UDP, which is faster than TCP-based VPNs but can be easliy blocked or throttled by some networks.
Better DoS protection
WireGuard improves on the IP-binding cookie mechanisms used in IKEv2 and DTLS by adding encryption and authentication to the cookie itself — making denial-of-service mitigation significantly more robust.
Small enough to audit
Perhaps the most striking aspect of WireGuard is its size: the entire Linux implementation fits in under 4,000 lines of code. Compare that to OpenVPN's ~100,000+ lines and the security implications become obvious. A smaller codebase means a smaller attack surface, and one that's actually feasible to audit and verify.
How to Install WireGuard VPN on Ubuntu and Configure it as a server.
1) Update packages and install WireGuard.
sudo apt update && sudo apt install -y wireguard
2) Generate server private and public key pair.
wg genkey | sudo tee /etc/wireguard/private.key
sudo chmod go= /etc/wireguard/private.key
sudo cat /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key
3) View the generated private & public keys — you will need them in the WireGuard config.
sudo cat /etc/wireguard/private.key
sudo cat /etc/wireguard/public.key
4) Find your actual network interface name — it will be the one associated with your server's public IP such as ens160 and eth0.
ip a
5) Create your WireGuard server configuration file. You can name the virtual network interface anything you like, such as wg0.conf or custom-name.conf. Let's name it as name0.conf.
sudo nano /etc/wireguard/name0.conf
[Interface]
PrivateKey = Copy /etc/wireguard/private.key to here
ListenPort = 443
Address = 192.168.50.1/24
## Enable IP forwarding (for routing)
## Please check your network interface name such as ens160.
## Please check that -i name0 same as your config file name.
PostUp = iptables -A FORWARD -i name0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens160 -j MASQUERADE
PostDown = iptables -D FORWARD -i name0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens160 -j MASQUERADE
## Client 1
[Peer]
PublicKey = Paste your mac client's public key here.
AllowedIPs = 192.168.50.2/32
## Client xN
[Peer]
PublicKey = Paste your widows or any client's public key here.
AllowedIPs = 192.168.50.3/32
6) Enable IP forwarding in the kernel so that server acts as a router, passing traffic between your VPN clients and the outside network.
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p
7) Start WireGuard and enable on boot and verify the interface is up.
sudo systemctl enable wg-quick@name0
sudo systemctl start wg-quick@name0
sudo wg show
8) If UFW is enabled, open the WireGuard port in the firewall.
ufw allow 443/udp
9) Every time you update the WireGuard configuration file, remember to restart the WireGuard service for the changes to take effect.
sudo systemctl restart wg-quick@name0
How to Install WireGuard VPN on Mac and Configure it as a client.
Install the official WireGuard app from the Mac App Store: Download
Click 'Add Empty Tunnel' in the app and paste the client config below. Make sure the client IP address (e.g. 192.168.50.2/24) matches the AllowedIPs value set for this peer in your server's /etc/wireguard/name0.conf.
[Interface]
PrivateKey = This is auto generated. Do not share it with anyone.
Address = 192.168.50.2/24
DNS = 8.8.8.8, 1.1.1.1
[Peer]
PublicKey = Copy vpn server /etc/wireguard/public.key to here
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = VPN_SERVER_IP:443
PersistentKeepalive = 5
Once the connection is established, the AllowedIPs = 0.0.0.0/0, ::/0 setting will route all IPv4 and IPv6 traffic through your VPN server, changing your Mac's public IP to your server's IP.
If you only want a private network without changing your public IP, set AllowedIPs to your VPN subnet (e.g. 192.168.50.0/24) and restart the WireGuard client.
Make sure you have added your Mac client's public key to your VPN server config at /etc/wireguard/name0.conf:
## Client 1
[Peer]
PublicKey = Paste your mac client's public key here.
AllowedIPs = 192.168.50.2/32
Then restart the VPN server:
sudo systemctl restart wg-quick@name0
That's it — enjoy your self-hosted, free, and open-source VPN!