{
  "id": 8885613,
  "title": "Setting up a WireGuard VPN: secure access to your own server",
  "url": "https://urgent.news/2026/09/21/setting-up-a-wireguard-vpn-secure-access-to-your-own-server",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-21T08:50:23.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/serverkueche/setting-up-a-wireguard-vpn-secure-access-to-your-own-server-5hgc"
  },
  "original_language": "en",
  "account": "To establish secure access to your server using WireGuard, you'll need to configure a VPN tunnel directly on the server. This will allow your devices, whether it's a laptop or phone, to establish an encrypted connection to the server and obtain a private IP address within the 10.8.0.0/24 network range.\n\nWireGuard is a lightweight and stable solution that runs directly in the Linux kernel, providing a secure tunnel without opening additional ports to the internet. You have the option to enable split tunneling, which secures only specific traffic (like an admin dashboard or database) while allowing other internet traffic to bypass the VPN. Alternatively, you can enable full tunneling, which routes all internet traffic through the server, adding an extra layer of security when using public Wi-Fi networks.\n\nBefore proceeding, ensure you have a server with UFW firewall and root or sudo access, along with a client device equipped with the official WireGuard app for their respective operating system. Once these prerequisites are met, you can begin the setup process.\n\nTo install WireGuard, update your system and install the necessary tools and qrencode for QR code generation. Verify that the kernel module is loaded and successfully running. Next, generate key pairs for authentication using WireGuard's key generation command. The private key should be kept strictly confidential as it should never leave the server. Repeat this process for each client device you wish to connect.\n\nCreate a server configuration file, specifying the private server key and the corresponding public client keys. Define the server's internal IP address within the VPN subnet (10.8.0.1) and the client's fixed tunnel IP (10.8.0.2). This configuration establishes the secure connection parameters between the server and client devices.\n\nOpen the required firewall port (51820 for UDP) and enable the WireGuard service to start the tunnel. Verify that the interface is active by checking the WireGuard status. Upon successful setup, create a client configuration file that mirrors the server configuration, replacing the private keys accordingly. The client configuration defines the endpoint (server's public IP and port) and the allowed internal IP range for routing traffic through the VPN tunnel.\n\nThe client configuration also includes a DNS setting. While the server can route DNS requests internally, it's only recommended if a DNS resolver is running on the server. Otherwise, using a public DNS service like 1.1.1.1 is more practical. A persistent keepalive is set to maintain the connection when the client device is idle.",
  "summary": "So far, everything on your server is publicly reachable behind Traefik. But some things should run only for you – an admin dashboard, a database, an internal service. With WireGuard you build yourself an encrypted tunnel straight into the server, without opening any further ports to the internet. What are we building? A WireGuard VPN natively on the server (no container – WireGuard is in the…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}