Learn how to set up WireGuard on Ubuntu 26.04 LTS with a secure VPN tunnel, key generation, routing, and verification.

Introduction

This tutorial shows how to install and configure WireGuard on Ubuntu 26.04 LTS for a dedicated server, bring up the interface with systemd, and confirm the VPN tunnel is working as expected.

You will create the server keys, define a minimal interface configuration, enable IPv4 forwarding for routed traffic, and verify the resulting tunnel state. The focus is a working WireGuard deployment that experienced administrators can adapt to their own peer and routing requirements.

Prerequisites

• An Ubuntu 26.04 LTS dedicated server with network access to install packages
• Root access or a normal administrative user with sudo privileges
• A client peer ready to connect to this WireGuard server
• Optional reference material for related Ubuntu server tasks, such as Secure SSH on Ubuntu 26.04 with Key Authentication and Fail2ban

Tutorial steps

Install WireGuard

Update the package index and install the WireGuard packages required for the server interface and key utilities.

sudo apt update
sudo apt install -y wireguard wireguard-tools

Generate Server Keys

Create a private key and matching public key in a directory protected by a restrictive umask.

umask 077
wg genkey | tee server-private.key | wg pubkey > server-public.key

Keep the private key secret. You will place it in the WireGuard configuration file in the next step.

Create the WireGuard Server Configuration

Open the interface configuration file and define the server address, listen port, private key, and peer stanzas required for your deployment.

sudo nano /etc/wireguard/wg0.conf

Use a configuration that matches your intended tunnel design. At minimum, the server file needs an [Interface] section with the private key, the internal VPN address, and the UDP listen port. Add [Peer] entries for each client that should be allowed to connect.

If this is the first time you are setting up the server, you can also review how the access model fits alongside other security controls on the system, such as the SSH guidance in Secure SSH on Ubuntu 26.04 with Key Authentication and Fail2ban.

Enable IP Forwarding

Enable IPv4 forwarding immediately so routed VPN traffic can pass through the server, then persist the setting across reboots.

sudo sysctl -w net.ipv4.ip_forward=1
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-wireguard.conf

Start and Enable the WireGuard Interface

Bring up the wg0 interface with systemd so it starts now and remains enabled on boot.

sudo systemctl enable --now wg-quick@wg0

If the service fails to start, inspect the unit status before changing the configuration.

sudo systemctl status wg-quick@wg0

Verification

Confirm that the interface is active, that WireGuard sees the expected state, and that IPv4 forwarding is enabled for routing.

sudo wg show

The output should display the interface name, its private key status, the listen port, and the peer details once a client connects. After a successful connection, you should also see a recent handshake timestamp for the peer.

Verify that the kernel interface exists and has the internal VPN address you configured in /etc/wireguard/wg0.conf. The exact address depends on your tunnel plan, but it should match the server-side Address setting.

To confirm routing support, check that IPv4 forwarding remains enabled after you persist the sysctl setting. The server should report net.ipv4.ip_forward = 1 when you inspect the active value.

Troubleshooting

If wg-quick@wg0 does not start, begin with the systemd status output and correct any syntax or file permission issues in the configuration.

Common causes include an invalid private key path or contents, a malformed [Interface] or [Peer] section, or a missing interface address. Recheck the file you edited with sudo nano /etc/wireguard/wg0.conf and restart the unit after fixing the problem.

If the interface comes up but no handshake appears in sudo wg show, verify that the client has the correct peer public key, endpoint, and allowed addresses, and confirm that the client is actually connecting to the server.

If routed traffic does not pass through the tunnel, recheck IPv4 forwarding and confirm it remains set to 1. A forwarding value of 0 means the server will not route traffic through the VPN.

Rollback

To remove the WireGuard interface, stop and disable the systemd unit, then remove the configuration file if you no longer need the tunnel.

sudo systemctl disable --now wg-quick@wg0

If you want to revert the forwarding change as well, edit or remove the sysctl drop-in you created and set IPv4 forwarding back to 0 as needed for your environment.

Conclusion

You have set up WireGuard on Ubuntu 26.04 LTS for a dedicated server, enabled routing support, and brought the interface under systemd control. You can now verify that the service is active, the VPN interface has the expected internal address, IPv4 forwarding is enabled, and WireGuard reports a handshake after a client connects.