The source

Two small, readable scripts and a couple of config templates — that's the whole VPN. Nothing here is proprietary: it's the stock WireGuard + wg-quick setup, written out so you can read every line before you trust it. Copy it, download it, fork it, change it. It's yours.

wg-setup.sh
Download

Run once on a fresh server (as root). Installs WireGuard, enables forwarding + NAT, generates the server keys, opens the port, and starts the tunnel on boot. Idempotent — safe to re-run. 

Loading…  ·  view raw
wg-add-client.sh
Download

Add one device: generates its keypair, reserves the next address, wires the peer into the running server with no downtime, and prints the client .conf plus a QR code for phones. 

Loading…  ·  view raw

Config templates

If you'd rather not run the scripts, these are the only two files that matter. Server side, /etc/wireguard/wg0.conf: 

[Interface]
Address = 10.7.0.1/24
ListenPort = 51820
PrivateKey = <server private key>
PostUp   = iptables -t nat -A POSTROUTING -s 10.7.0.0/24 -o eth0 -j MASQUERADE; iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -s 10.7.0.0/24 -o eth0 -j MASQUERADE; iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT

[Peer]
# one block per device
PublicKey = <client public key>
AllowedIPs = 10.7.0.2/32

Client side, the .conf you import into the WireGuard app: 

[Interface]
PrivateKey = <this device's private key>
Address = 10.7.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = <server public key>
Endpoint = your.server.ip:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

Build a client config in your browser

Don't want to type keys? The config builder generates a WireGuard keypair locally — the private key never leaves your device — and assembles a ready-to-import .conf from your server's public key and endpoint.

Open the config builder Back to the guide

License & warranty

Public domain, do-whatever. There's no warranty — it's your server and your responsibility. WireGuard itself is by Jason A. Donenfeld and the WireGuard project; these scripts just wire it together. Audit them, then own them.