Setup VPN WireGuard (Debian/Ubuntu VPS)

1. Installazione server

apt update && apt install -y wireguard

2. Genera le chiavi

cd /etc/wireguard
wg genkey | tee server.key | wg pubkey > server.pub

3. Configurazione /etc/wireguard/wg0.conf

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <contenuto di server.key>

PostUp   = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Verifica l'interfaccia di uscita con ip a — su molti VPS è ens3 invece di eth0.

4. Abilita il forwarding

sysctl -w net.ipv4.ip_forward=1
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf

5. Avvia e abilita all'avvio

wg-quick up wg0
systemctl enable wg-quick@wg0

6. Apri la porta sul firewall

ufw allow 51820/udp

7. Config client

[Interface]
Address = 10.0.0.2/24
PrivateKey = <client private key>
DNS = 1.1.1.1

[Peer]
PublicKey = <contenuto di server.pub>
Endpoint = <IP-del-VPS>:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Sul server aggiungi il peer:

wg set wg0 peer <client public key> allowed-ips 10.0.0.2/32

App client: wireguard.com/install — Windows, macOS, Linux, iOS, Android. Genera un QR code con qrencode -t ansiutf8 < client.conf.