Set Up a WireGuard VPN on Your Home Server in 20 Minutes

By
wireguard vpn homelab networking security

WireGuard is 4,000 lines of code. OpenVPN is 600,000. Fewer lines means a smaller attack surface, faster handshakes and speeds that actually match your connection.

This guide uses wg-easy — a Docker container that wraps WireGuard with a web UI for managing peers.

Prerequisites

  • A Linux server or VM on your home network (Ubuntu 22.04+ or Debian 12)
  • A port you can forward on your router (UDP, default 51820)
  • Docker installed

Install wg-easy

docker run -d \
  --name=wg-easy \
  -e WG_HOST=your.domain.or.ip \
  -e PASSWORD=changeme \
  -v ~/.wg-easy:/etc/wireguard \
  -p 51820:51820/udp \
  -p 51821:51821/tcp \
  --cap-add=NET_ADMIN \
  --cap-add=SYS_MODULE \
  --sysctl="net.ipv4.conf.all.src_valid_mark=1" \
  --sysctl="net.ipv4.ip_forward=1" \
  --restart unless-stopped \
  ghcr.io/wg-easy/wg-easy

Replace your.domain.or.ip with your public IP or a dynamic DNS hostname.

Port Forwarding

Log into your router and forward UDP port 51820 to the internal IP of your Docker host. If your ISP assigns a dynamic IP, set up a free dynamic DNS service — DuckDNS works well and integrates easily.

Create Your First Peer

Open http://your-server-ip:51821 in a browser. Log in with the password you set. Click "New Client," name it (e.g. "phone" or "laptop"), and download or scan the QR code.

Install the WireGuard app:

  • WireGuard for Android — on the Play Store
  • WireGuard for iOS — App Store
  • WireGuard for Windows/Mac — wireguard.com/install

Import the config via QR code or file. Toggle the VPN on. Your traffic now routes through your home network.

Verify It Works

With the VPN connected on your phone, visit https://whatismyip.com. It should show your home IP, not your mobile carrier's IP.

Security Hardening

  • Change the web UI password from the default immediately
  • Put the wg-easy management port (51821) behind your firewall — it should not be publicly accessible
  • Use a subdomain with Nginx Proxy Manager in front of the UI if you need remote management access
  • Rotate peer keys every few months for sensitive devices

Hardware Note

Any machine running Docker handles this fine. A Raspberry Pi 4 4GB runs wg-easy for 5–10 peers without breaking a sweat.

As an Amazon Associate, IT Lad earns from qualifying purchases made through links on this page. Read the full affiliate disclosure.

Previous Post Next Post