Why self-host WireGuard on a VPS
Commercial VPNs pool thousands of users on the same IP addresses, often keep logs and throttle bandwidth. By deploying WireGuard on your own VPS, you get a dedicated egress IP address, throughput guaranteed by your plan and a logging policy you define yourself. WireGuard works over UDP on a single port, integrates directly into the Linux kernel and negotiates a connection in a fraction of OpenVPN's time. For a developer or an agency, it's also the cleanest way to access internal services (database, admin panel, monitoring) without exposing them publicly: you bind them to the VPN interface only.
Concrete benefits of a self-hosted WireGuard
- Dedicated and stable egress IP, ideal for whitelisting API access or back-offices.
- Modern ChaCha20-Poly1305 encryption with a minimal attack surface (4,000 lines of code).
- Throughput close to native and near-instant reconnection after a network drop (roaming).
- Private access to your internal services by binding them to the VPN subnet (10.0.0.0/24) rather than to 0.0.0.0.
- No third-party activity logs: you fully control data retention.
- Fixed and predictable cost, independent of the number of connected devices.
Requirements for this deployment
WireGuard is extremely lightweight: a VPS with 1 vCPU and 1 GB of RAM is more than enough for a dozen clients, the limiting factor being bandwidth rather than CPU. Plan for Docker and Docker Compose installed (or the native wireguard-tools package), a recent Linux kernel (5.6+ integrates WireGuard natively) and the opening of a UDP port, by convention 51820. A domain name pointing to your VPS (an A record vpn.mydomain.com) is recommended to distribute client configurations, but the public IP alone works too.
Deploy WireGuard in a container
Enable IP forwarding on the VPS
The server must route the tunnel traffic to the Internet. Add net.ipv4.ip_forward=1 in /etc/sysctl.conf then apply with sudo sysctl -p. Without this, clients connect but have no outbound access.
Start the wg-easy container
The wg-easy project provides WireGuard plus a web interface for peer management. In a docker-compose.yml, define WG_HOST=vpn.mydomain.com, an admin password and expose 51820/udp as well as 51821/tcp for the UI. Start with docker compose up -d.
Open the UDP port at the firewall
Allow inbound traffic on the tunnel port: sudo ufw allow 51820/udp. However, restrict access to the admin UI (51821) to your IP only or place it behind the VPN once the first client is connected.
Protect the administration interface with SSL
Place a reverse proxy (Caddy or Traefik) in front of port 51821 to serve the UI over HTTPS on vpn.mydomain.com with an automatic Let's Encrypt certificate. Never leave the admin panel accessible over plain HTTP on the Internet.
Create a peer and import the configuration
From the UI, add a client: wg-easy generates a key pair and a QR code. Scan it with the WireGuard mobile app, or download the .conf file for wg-quick up. The client is operational immediately.
Verify the tunnel
Once connected, check your public egress IP (it should be that of the VPS) and the handshake state on the server side with docker exec wg-easy wg show. A recent latest handshake value confirms that the tunnel is active.
To turn your VPN into a gateway for accessing internal services without exposing everything, only allow the VPN subnet (for example 10.8.0.0/24) in the client's AllowedIPs instead of 0.0.0.0/0. You thus get a "split" tunnel: only traffic to your private services goes through the VPS, the rest of your browsing exits via your local connection. Combine it with a kill-switch via PostUp/PostDown to prevent any leak if the tunnel goes down.
