How to Set Up a High-Speed WireGuard VPN on Ubuntu

The Modern Standard of Cryptography

Legacy VPN protocols are bogged down by millions of lines of code. WireGuard changes the game by operating directly inside the Linux kernel, offering unprecedented speeds and state-of-the-art cryptography. You open your terminal, connect to your KVM VPS, and prepare to build a tunnel that cannot be compromised. Before typing the installation command, ensure your firewall is active. If you skipped this step, review our Securing Your Server guide to protect your environment.

Installing the Kernel Module

With a secured foundation, you instruct the package manager to pull the latest WireGuard binaries. The console text flies across the screen as Ubuntu resolves the dependencies and installs the core tools in a matter of seconds. Execute the following commands to update your system and install the package:

sudo apt update && sudo apt upgrade -y
sudo apt install wireguard -y

Forging Your Cryptographic Keys

WireGuard does not rely on complex certificate authorities. It uses simple, incredibly strong public-key cryptography. You need to generate a private key for your server and extract its corresponding public key. Run this exact command sequence in your terminal to create the key pair and set the correct file permissions to protect them from unauthorized read access:

wg genkey | sudo tee /etc/wireguard/private.key
sudo chmod go= /etc/wireguard/private.key
sudo cat /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key

Defining the Tunnel Configuration

With your cryptographic armor forged, you must define how the network traffic routes through your CLOUD HIVE DC server. Open the Nano text editor to create the primary configuration file. Your fingers fly across the keyboard as you type:

sudo nano /etc/wireguard/wg0.conf

In the blank editor screen, paste the following routing rules. You must read your private key file using the cat command and replace the placeholder below with that exact string of characters:

[Interface]
PrivateKey = YOUR_SERVER_PRIVATE_KEY
Address = 10.8.0.1/24
ListenPort = 51820
SaveConfig = true

Activating the Secure Interface

Save the configuration file and enable IPv4 forwarding so your server can route packets to the broader internet. Finally, you bring the WireGuard interface online. The terminal remains completely silent, returning a simple prompt, but a quick status check reveals your new, impregnable network is actively listening for connections:

echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.d/99-sysctl.conf
sudo sysctl -p
sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0
sudo wg show