VPN Tutorial

2026 Latest: Setting Up a WireGuard VPN Server on Ubuntu 26.04 LTS with Cross-Platform Client Configuration

Date Published

2026 Latest: Setting Up a WireGuard VPN Server on Ubuntu 26.04 LTS with Cross-Platform Client Configuration

Summary: A detailed illustrated guide to deploying a WireGuard server on Ubuntu 26.04 step by step and configuring clients on Android, iOS, Windows, and Mac — secure, fast, and up and running in 10 minutes.

Table of Contents

Introduction

WireGuard is a next-generation high-performance VPN protocol known for its minimal configuration, kernel-level speed, and strong encryption. This tutorial uses Ubuntu 26.04 LTS as the server and walks you through installation, configuration, and securely connecting devices across all platforms — Android, iPhone, Windows, and Mac. Even if you have never worked with a VPN before, you can get it up and running in just 10 minutes.

Server Configuration

Environment: Ubuntu 26.04 LTS (similar steps apply to other Debian-based distributions)
All commands are executed as a sudo user or root.

Install WireGuard

sudo apt update
sudo apt install wireguard -y

Generate Keys and Basic Configuration

1. Generate server key pair

# Generate server private key
sudo wg genkey | sudo tee /etc/wireguard/server_private.key
sudo chmod 600 /etc/wireguard/server_private.key
# Derive server public key
sudo cat /etc/wireguard/server_private.key | wg pubkey | sudo tee /etc/wireguard/server_public.key

2. Get the main network interface name

ip -o -4 route show to default | awk '{print $5}'

Remember the output (e.g., eth0); you will need to substitute it in the configuration later.

3. Create the server configuration file

sudo nano /etc/wireguard/wg0.conf

Fill in the following content (make sure to replace PrivateKey and the network interface name):

[Interface]
Address = 10.8.0.1/24
SaveConfig = true
PrivateKey = <paste server private key here>
ListenPort = 51820
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE
PreDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Firewall and IP Forwarding

Enable IP forwarding

echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Allow the port in the firewall

  • UFW firewall: 
    sudo ufw allow 51820/udp
  • Cloud server security group: Log in to your cloud console, add an inbound rule with the protocol UDP, port 51820, and source 0.0.0.0/0.

Start WireGuard and enable it to start at boot

sudo systemctl start wg-quick@wg0
sudo systemctl enable wg-quick@wg0

Adding a Client Peer

Generate a key pair for the client (example client name client1)

# Generate client private key
sudo wg genkey | sudo tee /etc/wireguard/client1_private.key
sudo chmod 600 /etc/wireguard/client1_private.key
# Derive client public key
sudo cat /etc/wireguard/client1_private.key | wg pubkey | sudo tee /etc/wireguard/client1_public.key

Add the client to the server (choose one method)

  • Add dynamically (no restart required): 
    sudo wg set wg0 peer $(sudo cat /etc/wireguard/client1_public.key) allowed-ips 10.8.0.2/32
  • Edit the configuration file /etc/wireguard/wg0.conf and add the following at the end: 
    [Peer]
PublicKey = <client public key>
AllowedIPs = 10.8.0.2/32
    Then restart: sudo systemctl restart wg-quick@wg0

For each additional client, assign a different virtual IP, such as 10.8.0.2/32, 10.8.0.3/32, etc.

Generating Client Configuration Files

On the server, create client1.conf and fill in the following content (replace the placeholders):

[Interface]
PrivateKey = <client private key>
Address = 10.8.0.2/24
DNS = 8.8.8.8

[Peer]
PublicKey = <server public key>
Endpoint = <server public IP>:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Convenient distribution: Install qrencode to convert the configuration file into a QR code; clients can scan it to import.

sudo apt install qrencode -y
qrencode -t ansiutf8 < client1.conf

Cross-Platform Client Connection Guide

Android Client

  1. Install WireGuard from Google Play
  2. Open the app → tap the + button at the bottom right → Import from file or archive to select the .conf file, or Scan from QR code to scan the QR code generated on the server
  3. Tap the toggle to connect

iOS Client

  1. Install WireGuard from the App Store
  2. Open the app → tap + at the top right → Create from file or archive, or Create from QR code
  3. Allow adding the VPN configuration and tap the toggle to connect

Windows Client

  1. Download the WireGuard installer from the official website
  2. Launch the program → Import tunnel(s) from file → select the .conf file
  3. Click the Activate button; the status turns green upon a successful connection

macOS Client

  1. Search for and install WireGuard from the App Store, or directly download the DMG package
  2. Open WireGuard → Import Tunnel(s) from File → select the configuration file
  3. Click Activate to connect

Verification and Troubleshooting

Check server status

sudo wg show

You should see a latest handshake time within 2 minutes, indicating a successful connection.

Client verification Visit ip.sb or run curl ifconfig.me. The displayed IP should be your server's public IP.

If you cannot connect, check the following one by one:

  • Is UDP port 51820 allowed in the cloud firewall security group?
  • Is IP forwarding enabled? Run sysctl net.ipv4.ip_forward — it should output 1
  • Do the iptables NAT rules exist? Run sudo iptables -t nat -L POSTROUTING and verify that MASQUERADE is present
  • Does the server's peer public key match the client's private key?
  • Is the Endpoint public IP in the client configuration file correct?

Frequently Asked Questions (FAQ)

Q: Why can I ping but not open web pages?
A: This is usually a DNS issue. Explicitly set DNS = 8.8.8.8 in the client configuration, or try another public DNS server.

Q: How can I allow the client to access only the internal network without affecting other traffic?
A: Change AllowedIPs in the client configuration to 10.8.0.0/24 (or your desired internal subnet) instead of 0.0.0.0/0.

Q: How do I add more clients?
A: Repeat the “Adding a Client Peer” steps: generate a new key pair, assign a new IP address, and add it to the server.

Q: Will the VPN disconnect after the server reboots?
A: As long as you have run systemctl enable wg-quick@wg0, it will automatically recover on boot.

Q: Is the configuration file secure? How should I send it to a phone?
A: The configuration file contains a private key and must be transferred over an encrypted channel. It is recommended to use QR code scanning, and you can clear the terminal history after a single use.

Summary
You now have a complete WireGuard deployment: the server runs on Ubuntu 26.04 LTS, and all major client platforms can connect effortlessly. Whether for remote work, home network access, or secure proxying, you will enjoy a stable and high-speed experience.