How to Set Up a High-Speed WireGuard VPN Server on a Cheap Ubuntu Cloud VPS

Why WireGuard Has Replaced OpenVPN and IPsec

For decades, legacy VPN protocols like OpenVPN and IPsec dominated enterprise secure networking. However, these older protocols suffer from massive codebases (exceeding 100,000 lines of code), slow handshake negotiation times, high battery consumption on mobile devices, and significant CPU context switching overhead that throttles bandwidth speeds.

WireGuard is a modern, state-of-the-art cryptographic VPN protocol implemented directly within the Linux kernel. With an ultra-compact codebase of under 4,000 lines, WireGuard utilizes cutting-edge cryptography (Curve25519, ChaCha20, Poly1305, and BLAKE2s). It establishes connections instantly in sub-milliseconds, consumes virtually zero battery on mobile smartphones, and delivers full line-speed gigabit encrypted throughput on affordable $3–$5/month cloud VPS instances.

In this comprehensive network configuration tutorial, we will configure a dedicated WireGuard VPN server on Ubuntu 24.04/22.04 LTS, enable Linux kernel IPv4/IPv6 packet forwarding, configure UFW NAT masquerading, and generate QR codes for one-click iOS and Android mobile pairing.

Step 1: Installing WireGuard and Cryptographic Tools

WireGuard is included directly in the Ubuntu Linux kernel. Install the userspace control tools and QR code generator:

# Update package list and install WireGuard + QREncode
sudo apt update && sudo apt install -y wireguard qrencode iptables ufw

# Verify kernel module availability
sudo modprobe wireguard

Step 2: Generating Server and Client Cryptographic Keypairs

WireGuard authenticates peers using asymmetric public-key cryptography similar to SSH:

# Create dedicated directory with restricted permissions
sudo mkdir -p /etc/wireguard
cd /etc/wireguard
sudo umask 077

# Generate Server private and public keys
wg genkey | sudo tee server_private.key | wg pubkey | sudo tee server_public.key

# Generate Client (Peer 1) private and public keys
wg genkey | sudo tee client1_private.key | wg pubkey | sudo tee client1_public.key

Step 3: Enabling Linux Kernel IPv4 and IPv6 Forwarding

To allow your VPS to route Internet traffic from connected VPN clients out to the public web, enable IP forwarding in /etc/sysctl.conf:

# Enable IPv4 and IPv6 packet forwarding
sudo sysctl -w net.ipv4.ip_forward=1
sudo sysctl -w net.ipv6.conf.all.forwarding=1

# Persist settings across server reboots
echo 'net.ipv4.ip_forward=1' | sudo tee -a /etc/sysctl.conf
echo 'net.ipv6.conf.all.forwarding=1' | sudo tee -a /etc/sysctl.conf

Step 4: Writing Server Interface Configuration (wg0.conf)

Find your primary public network interface name (usually eth0 or ens3) using ip route | grep default. Then create /etc/wireguard/wg0.conf:

[Interface]
Address = 10.66.66.1/24, fd42:42:42::1/64
ListenPort = 51820
PrivateKey = <PASTE_SERVER_PRIVATE_KEY_HERE>
SaveConfig = false

# PostUp NAT Routing Directives (Replace 'eth0' with your actual interface)
PostUp = ufw route allow in on wg0 out on eth0
PostUp = iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE
PostUp = ip6tables -t nat -I POSTROUTING -o eth0 -j MASQUERADE

# PostDown Teardown Directives
PostDown = ufw route delete allow in on wg0 out on eth0
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
PostDown = ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

# --- Client 1: iPhone / Laptop ---
[Peer]
PublicKey = <PASTE_CLIENT1_PUBLIC_KEY_HERE>
AllowedIPs = 10.66.66.2/32, fd42:42:42::2/128

Step 5: Configuring UFW Firewall and Starting WireGuard

# Allow WireGuard UDP listening port
sudo ufw allow 51820/udp comment 'WireGuard VPN'
sudo ufw reload

# Enable and start the WireGuard systemd service
sudo systemctl enable --now wg-quick@wg0

# Inspect active WireGuard interface status
sudo wg show

Step 6: Generating Client Configuration & QR Code for Mobile

Create the client configuration file at /etc/wireguard/client1.conf:

[Interface]
PrivateKey = <PASTE_CLIENT1_PRIVATE_KEY_HERE>
Address = 10.66.66.2/24, fd42:42:42::2/64
DNS = 1.1.1.1, 1.0.0.1

[Peer]
PublicKey = <PASTE_SERVER_PUBLIC_KEY_HERE>
Endpoint = YOUR_VPS_PUBLIC_IP:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

Generate a terminal QR code to scan directly with the official WireGuard iOS or Android app:

qrencode -t ansiutf8 < /etc/wireguard/client1.conf

WireGuard vs OpenVPN Performance Benchmark

Adding Multiple Client Devices (Laptops, Desktops, Servers)

To connect additional devices (such as a MacBook, Windows workstation, or remote staging server), generate a new peer keypair and append a unique [Peer] section to /etc/wireguard/wg0.conf:

# Generate keys for Peer 2 (Laptop)
wg genkey | sudo tee /etc/wireguard/laptop_private.key | wg pubkey | sudo tee /etc/wireguard/laptop_public.key

# Append Peer block to /etc/wireguard/wg0.conf
[Peer]
# Laptop Client
PublicKey = <PASTE_LAPTOP_PUBLIC_KEY>
AllowedIPs = 10.66.66.3/32

Reload the interface dynamically without terminating active VPN connections:

sudo wg syncconf wg0 <(wg-quick strip wg0)

Benchmarking WireGuard Network Latency & Speed

# Test end-to-end encrypted latency
ping 10.66.66.1

# Run iperf3 throughput benchmark
# On Server:
iperf3 -s

# On Client:
iperf3 -c 10.66.66.1 -P 4

Security & Hardening Recommendations for WireGuard

• Use Pi-hole / AdGuard for DNS: Point WireGuard client DNS to an internal local Pi-hole instance (DNS = 10.66.66.1) for network-wide ad and malware blocking.
• Enable PersistentKeepalive: Set PersistentKeepalive = 25 on clients behind restrictive NATs or mobile firewalls to keep the tunnel open.