natbox.io

Guides / WireGuard VPN

Run a WireGuard VPN

About 15 minutes. Any plan; Nano is plenty for a few devices. Debian or Ubuntu commands; the config is the same on every OS.

WireGuard works in natbox containers. It needs one UDP port, so pick one of your forwarded ports, for example 10001. Your traffic leaves through our shared IPv4 address, and over IPv6 your devices can use addresses from your own /80.

1. Set up the server

apt update && apt install -y wireguard nftables
cd /etc/wireguard && umask 077
wg genkey | tee server.key | wg pubkey > server.pub
wg genkey | tee phone.key | wg pubkey > phone.pub

Create /etc/wireguard/wg0.conf (replace the keys with the contents of the files, and 10001 with your port):

[Interface]
Address = 10.8.0.1/24
ListenPort = 10001
PrivateKey = (contents of server.key)
PostUp = nft add table ip wgnat; nft add chain ip wgnat post '{ type nat hook postrouting priority 100; }'; nft add rule ip wgnat post oifname "eth0" ip saddr 10.8.0.0/24 masquerade
PostDown = nft delete table ip wgnat

[Peer]
PublicKey = (contents of phone.pub)
AllowedIPs = 10.8.0.2/32
echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/90-wireguard.conf && sysctl --system
systemctl enable --now wg-quick@wg0
wg show

2. Set up your device

In the WireGuard app, add a tunnel with:

[Interface]
PrivateKey = (contents of phone.key)
Address = 10.8.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = (contents of server.pub)
Endpoint = natbox.io:10001
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Connect, then check your public IP on any "what is my IP" page: it shows 5.189.155.145.

Good to know