WireGuard VPN Server on a VPS: Setup, Users and Connections

When your server is ready, we email you its IP address, the root password and the link to your WireGuard UI panel. The same details are in your client area, under the server’s information.

1. Open the panel link from the email.
2. Log in with the username root.
3. Enter the root password from the same email.

docker restart wireguard-ui

Give each person or device its own client in the panel.

1. In the left menu, open WireGuard Clients.
2. Click New Client in the top-right corner.
3. Enter a Name. Leave IP Allocation and Allowed IPs as they are: 0.0.0.0/0 sends all of the device’s traffic through the VPN.
4. Keep the generated Preshared Key. It adds a second layer of encryption without slowing the connection.
5. Click Submit.
6. Click Apply Config in the top-right corner.

Use the official WireGuard app with the client’s configuration file.

1. Install the WireGuard app from wireguard.com or the Mac App Store.
2. In the panel, open WireGuard Clients, find the client and click Download.
3. In the app, click Import tunnel(s) from file and choose the downloaded file. The tunnel appears with the client’s name, marked Inactive.
4. Click Activate. The status changes to Active.

Phones and tablets can add the tunnel by scanning a QR code.

1. Install WireGuard from the App Store or Google Play.
2. In the panel, open WireGuard Clients, find the client and click QR code.
3. In the app, tap Add tunnel (+) and choose Create from QR code.
4. Scan the code and give the tunnel a name.
5. Allow the app to add VPN configurations when your phone asks.
6. Turn the tunnel on.

Download the client’s configuration file from the panel, then import it with NetworkManager:

sudo nmcli connection import type wireguard file "client.conf"
nmcli connection up client

The server also runs an HTTP proxy that is reachable only through the VPN, at 10.252.1.1 on port 3128. Set it in your browser’s proxy settings or with an extension such as SwitchyOmega.

1. Connect to the VPN first.
2. Install SwitchyOmega for Chrome or Firefox and open its options.
3. Click New profile, give it a name and choose Proxy Profile.
4. Set Protocol to HTTP, Server to 10.252.1.1 and Port to 3128.
5. Click Apply changes.
6. Click the SwitchyOmega icon and choose your new profile.

With the VPN on, search for “what is my IP” or open any IP lookup site. It should show your server’s IP address and location instead of your own.

Use this to set a new panel password or to reset a forgotten one. Connect to the server over SSH as root, edit the panel’s user file and restart the panel:

nano /data/wgui/users/root.json

# set a new password and clear the hash:
#   "password": "your-new-password",
#   "password_hash": "",

docker restart wireguard-ui

The panel runs in Docker containers that you can change if you need to.

1. Docker CE and Docker Compose.
2. WireGuard UI (ngoduykhanh/wireguard-ui), the web panel.
3. Nginx with Certbot (jonasal/nginx-certbot), which serves the panel over HTTPS.
4. Compose file: /root/wgui/compose.yml. Data: /data.

nano /root/wgui/compose.yml
cd /root/wgui && docker compose down && docker compose up -d