How to Set Up WireGuard VPN for Homelab Access

What is WireGuard

WireGuard is a modern, fast VPN protocol built into the Linux kernel. It's simpler to configure than OpenVPN, uses less CPU, and provides excellent performance. Perfect for accessing homelab services from anywhere.

Install WireGuard

apt update && apt install -y wireguard

Generate Keys

# On the server
wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key
chmod 600 /etc/wireguard/server_private.key

# For each client
wg genkey | tee client_private.key | wg pubkey > client_public.key

Server Configuration

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = 
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = 
AllowedIPs = 10.0.0.2/32

Save as /etc/wireguard/wg0.conf. Replace eth0 with your actual network interface. Enable IP forwarding:

echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p

Client Configuration

[Interface]
Address = 10.0.0.2/24
PrivateKey = 
DNS = 1.1.1.1

[Peer]
PublicKey = 
Endpoint = your-server-ip:51820
AllowedIPs = 10.0.0.0/24
PersistentKeepalive = 25

For split tunnel (only homelab traffic through VPN), set AllowedIPs = 10.0.0.0/24, 192.168.1.0/24. For full tunnel (all traffic), use AllowedIPs = 0.0.0.0/0.

Enable and Start

systemctl enable --now wg-quick@wg0
ufw allow 51820/udp

Phone/Tablet Client

Install the WireGuard app (iOS/Android). Import the client config by:

• Generating a QR code: apt install qrencode && qrencode -t ansiutf8 < client.conf
• Scan the QR code with the WireGuard app
• Or manually enter the config values

Troubleshooting

• No handshake: Check that port 51820/UDP is forwarded and not firewalled
• Connected but no internet: Verify IP forwarding is enabled and MASQUERADE rule is correct
• Can't reach homelab IPs: Check AllowedIPs includes your LAN subnet
• Connection drops: Add PersistentKeepalive = 25 to the client peer config

← Back to Knowledge Base