Ubuntu 26.04

How to Install WireGuard on Ubuntu 26.04

To install WireGuard on Ubuntu 26.04, run the VPN on this server and connect from an Ubuntu client on another network. Change 104.248.238.191 to this server's public IP.

Step 1 : Update.

sudo apt update

Step 2 : Install WireGuard.

sudo apt install wireguard iptables

Step 3 : Create the server keys.

wg genkey | sudo tee /etc/wireguard/private.key
sudo chmod 600 /etc/wireguard/private.key
sudo cat /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key

Step 4 : Unquoted EOF so $(…) expands. 10.8.0.1/24 is this server on the VPN (wg0), not a LAN address. Change eth0 to this server's public NIC. NAT sends client traffic out through this server.

sudo tee /etc/wireguard/wg0.conf <<EOF
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = $(sudo cat /etc/wireguard/private.key)
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
EOF
sudo chmod 600 /etc/wireguard/wg0.conf

Step 5 : Enable IP forwarding.

echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-wireguard.conf
sudo sysctl -p /etc/sysctl.d/99-wireguard.conf

Step 6 : Allow UDP 51820. Forward policy must ACCEPT or NAT drops packets.

sudo ufw allow 51820/udp
sudo sed -i 's/^DEFAULT_FORWARD_POLICY=.*/DEFAULT_FORWARD_POLICY="ACCEPT"/' /etc/default/ufw
sudo ufw reload

Step 7 : Enable and start.

sudo systemctl enable --now wg-quick@wg0

Step 8 : Check the interface.

sudo wg show

Step 9 : On the client (Ubuntu). Install WireGuard.

sudo apt update
sudo apt install wireguard

Step 10 : Keys on the client (do not create the private key on the server).

wg genkey | sudo tee /etc/wireguard/private.key >/dev/null
sudo chmod 600 /etc/wireguard/private.key
sudo cat /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key

Step 11 : Show the client public key. Paste it in step 12.

sudo cat /etc/wireguard/public.key

Step 12 : On the server — [Peer]. Paste the client public key. AllowedIPs = 10.8.0.2/32 is that client's VPN address.

sudo tee -a /etc/wireguard/wg0.conf <<'EOF'

[Peer]
PublicKey = nh4h7aDuP02yDN/YblEuyyaeuXdrN4MLuGkr8d8quGc=
AllowedIPs = 10.8.0.2/32
EOF
sudo systemctl restart wg-quick@wg0

Step 13 : On the client. Paste the server public.key. 10.8.0.2/24 is this client on the VPN (same 10.8.0.0/24 as the server). Change 104.248.238.191 to this server's public IP. AllowedIPs = 0.0.0.0/0 sends icanhazip through the tunnel.

sudo tee /etc/wireguard/wg0.conf >/dev/null <<EOF
[Interface]
PrivateKey = $(sudo cat /etc/wireguard/private.key)
Address = 10.8.0.2/24
[Peer]
PublicKey = 9x41RrKvuW5Uo3ZEWv5LTDUXQ7UDsFRLoaMNMxlAx00=
Endpoint = 104.248.238.191:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
EOF
sudo chmod 600 /etc/wireguard/wg0.conf

Step 14 : On the client. Bring the tunnel up, ping the server VPN address, then curl -4 for this server's public IPv4.

sudo wg-quick up wg0
ping -c 3 10.8.0.1
curl -4 -s http://icanhazip.com

This article uses Ubuntu as the client. You can use the WireGuard app on Windows or macOS with the same [Interface] / [Peer] tunnel file.

To add another client, generate a new key pair, pick a free VPN address (for example 10.8.0.3/24), add a [Peer] block on the server with that public key and AllowedIPs = 10.8.0.3/32, then restart wg-quick@wg0.

You have installed WireGuard on Ubuntu 26.04.