How to Set Up a WireGuard Server on Your Home Router

WireGuard is the protocol I'd hand to a friend setting up their first home VPN server. It's fast, the config is tiny, and the cryptography is modern without any knobs you can turn the wrong way. If you want to setup a WireGuard server on your home router or a small device on your home network, here's the full walkthrough, assuming no prior VPN experience.

Before you touch anything: three checks

Skip these and you'll join the large club of people whose tunnel "works on home WiFi but not from outside."

1. Can you administer your home router? You need its admin panel for port forwarding, unless the router itself will run the WireGuard server.

2. Do you have a real public IP? Look up your IP on any "what is my IP" site, then compare it with the WAN IP shown in your router's admin page. Same address? You're good. If the router shows something in 100.64.x.x to 100.127.x.x (or 10.x.x.x), your ISP has you behind CGNAT, and inbound WireGuard simply cannot reach you. In that case, stop here and use Tailscale instead. No shame in it; it's the right tool for that situation.

3. What runs the server? It needs to stay powered on whenever you want remote access. Good candidates: the router itself if it supports WireGuard server mode, a Raspberry Pi, a spare GL.iNet travel router, or a mini PC. A spare travel router is my favorite answer for beginners because the admin panel handles the fiddly bits.

While you're at it, set up a free DDNS hostname (your router may have one built in, or use a provider like DuckDNS). Home IPs change; a hostname means your client config survives that.

Building the server, step by step

These steps assume a Linux device (Raspberry Pi and similar). If your router has a WireGuard server toggle in its admin panel, use that instead. Same result, fewer commands.

Step 1: Install WireGuard.

sudo apt install wireguard

Step 2: Generate keys. Run this on the server, then once per client device:

wg genkey | tee privatekey | wg pubkey > publickey

Guard the private keys. The public keys get shared with the other end.

Step 3: Write the server config at /etc/wireguard/wg0.conf:

[Interface]
PrivateKey = <server private key>
Address = 10.0.0.1/24
ListenPort = 51820

[Peer]
# Laptop
PublicKey = <laptop public key>
AllowedIPs = 10.0.0.2/32

One [Peer] block per device. The server side just needs to know each client's public key and tunnel address.

Step 4: Let the server forward traffic. Clients' packets need to reach the internet through this box:

echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

(Adjust eth0 to your network interface.) Make the iptables rule persistent, e.g. with iptables-persistent, or it vanishes on reboot and you'll be debugging a "worked yesterday" mystery.

Step 5: Start it and make it survive reboots.

sudo wg-quick up wg0
sudo systemctl enable wg-quick@wg0

Step 6: Forward the port. In your home router's admin panel: UDP port 51820 goes to the server's LAN IP. First give the server a static DHCP lease so its LAN address can't drift out from under the rule. This single step is where most setups die. Double-check it.

The client side and the test that matters

Step 7: Write one client config per device:

[Interface]
PrivateKey = <client private key>
Address = 10.0.0.2/24
DNS = 10.0.0.1

[Peer]
PublicKey = <server public key>
Endpoint = your-home.ddns.net:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

AllowedIPs = 0.0.0.0/0 sends everything through home. PersistentKeepalive = 25 keeps NAT mappings alive. DNS pointed at the server prevents leaks.

Step 8: Test from a truly outside network. Phone off WiFi, on mobile data. Import the config into the WireGuard app, connect, and check your visible IP. It should be your home IP. If you test from home WiFi, you've tested nothing. I repeat this to everyone because everyone is tempted to skip it.

Step 9: Reboot the server and confirm it comes back. Power-cycle it, wait, and reconnect from mobile data. The setup you'll rely on from another continent is the one that recovers from a power cut without you.

Quick questions

Which port should WireGuard use?

51820/UDP is the default and fine. Some travelers switch to 443 or 53 to dodge restrictive hotel firewalls. If you change it, update the port forward and every client config to match.

Can my ISP tell I'm running a server?

They can see encrypted UDP traffic hitting your home IP, not what's inside it. A personal VPN server on a residential line is normal and legal in most places. If your ISP's terms bother you, read them, but this is routine.

How many devices can one server handle?

Dozens for personal use. Each needs its own key pair and tunnel address. The practical limit is your home upload bandwidth and the little CPU doing the encrypting.

Router-as-server or separate device?

Separate device, usually. It keeps working when you swap the main router, it's easier to update, and a bad config can't nuke the household internet. A spare travel router is the sweet spot.

Need help setting this up?

Keys, port forwarding, DDNS, NAT rules, client configs for every device, verified from an outside network: that's our done-for-you home IP VPN setup in a nutshell. Book it here: https://homeipvpn.com.