WireGuard VPN: Setting Up a Server and Clients, Generating Keys, and Routing Traffic

# Ubuntu 22.04+
sudo apt update && sudo apt install -y wireguard

# CentOS / RHEL
sudo yum install -y epel-release
sudo yum install -y wireguard-tools

# Generate server keys
wg genkey | sudo tee /etc/wireguard/server_private.key   | wg pubkey | sudo tee /etc/wireguard/server_public.key

# Generate client keys
wg genkey | tee client_private.key | wg pubkey > client_public.key

# Verify keys
sudo cat /etc/wireguard/server_private.key
sudo cat /etc/wireguard/server_public.key

# Set permissions
sudo chmod 600 /etc/wireguard/server_private.key

sudo nano /etc/wireguard/wg0.conf

[Interface]
PrivateKey = <server_private_key>
Address = 10.0.0.1/24         # VPN server internal IP
ListenPort = 51820
DNS = 1.1.1.1

# Internet sharing (optional) — route all client traffic through the server
PostUp   = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

# Client 1 (peer)
[Peer]
PublicKey = <client1_public_key>
AllowedIPs = 10.0.0.2/32      # This client's VPN IP

# Enable immediately
sudo sysctl -w net.ipv4.ip_forward=1

# Persist across reboots
echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

# Start WireGuard
sudo wg-quick up wg0

# Enable on boot
sudo systemctl enable --now wg-quick@wg0

# Check status
sudo wg show

# /etc/wireguard/wg0.conf (client)
[Interface]
PrivateKey = <client_private_key>
Address = 10.0.0.2/24          # Client VPN IP
DNS = 1.1.1.1

[Peer]
PublicKey = <server_public_key>
Endpoint = SERVER_PUBLIC_IP:51820
AllowedIPs = 0.0.0.0/0         # All traffic → VPN (full tunnel)
# AllowedIPs = 10.0.0.0/24     # VPN network only (split tunnel)
PersistentKeepalive = 25        # Keep NAT mappings alive

# Connect the client
sudo wg-quick up wg0

# Verify the connection
curl ifconfig.me    # Success if the server's public IP is returned
sudo wg show

sudo ufw allow 51820/udp
sudo ufw reload

# Add a new client
sudo wg set wg0 peer <new_client_public_key>   allowed-ips 10.0.0.3/32

# Persist to the config file
sudo wg-quick save wg0