> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opus-host.de/llms.txt
> Use this file to discover all available pages before exploring further.

# Set Up a WireGuard VPN Server on Your Opus Host VPS

> Run your own fast, modern VPN with WireGuard on your Opus Host VPS — route your traffic through your server for privacy and geo-flexibility.

WireGuard is a fast, minimal VPN protocol built into the Linux kernel. Running your own VPN on your Opus Host VPS is a great way to route your traffic through a server you control.

## 1. Install WireGuard

```bash theme={null}
sudo apt update
sudo apt install -y wireguard
```

## 2. Enable IP forwarding

```bash theme={null}
sudo sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/' /etc/sysctl.conf
sudo sysctl -p
```

## 3. Generate server keys

```bash theme={null}
cd /etc/wireguard
umask 077
wg genkey | sudo tee server_private.key | wg pubkey | sudo tee server_public.key
```

## 4. Create the server config

Create `/etc/wireguard/wg0.conf`:

```ini theme={null}
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <contents of server_private.key>

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
```

Replace `eth0` with your real network interface if different. Check with `ip -o link show`.

## 5. Open the firewall

```bash theme={null}
sudo ufw allow 51820/udp
```

See [Firewall](/vps/firewall) for the full UFW setup.

## 6. Start WireGuard

```bash theme={null}
sudo systemctl enable --now wg-quick@wg0
sudo wg
```

## 7. Add a client

On the **client** device, install WireGuard and generate its keys:

```bash theme={null}
wg genkey | tee client_private.key | wg pubkey > client_public.key
```

Create a client config:

```ini theme={null}
[Interface]
PrivateKey = <client_private.key>
Address = 10.8.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = <server_public.key>
Endpoint = your.vps.ip:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
```

On the **server**, add the client as a peer:

```bash theme={null}
sudo wg set wg0 peer <client_public.key> allowed-ips 10.8.0.2/32
sudo wg-quick save wg0
```

## 8. Connect

Import the client config into the WireGuard app on your phone or desktop and toggle it on.

<Tip>
  Generate multiple client configs (one per device) with different IPs (10.8.0.3, 10.8.0.4, ...). Never reuse the same key pair on two devices.
</Tip>

<Warning>
  Make sure the [Acceptable Use Policy](/account/rules) allows the VPN traffic you plan to route. Abusive traffic can get your VPS suspended.
</Warning>