Nanfeng

Notes on software development, code, and curious ideas

Building a WireGuard VPN Server on a Raspberry Pi

In ,
A modern replacement for the original PPTP tutorial, using WireGuard, forwarding, firewall rules, and secure client provisioning.

The original article used PPTP, a legacy VPN protocol that should no longer be deployed. A current Raspberry Pi or Ubuntu server can provide private remote access with WireGuard instead.

This example assumes the administrator owns the server and network, has a public or forwarded UDP port, and is permitted to operate a VPN in the relevant environment.

Install and create keys

1
2
3
4
sudo apt update
sudo apt install wireguard
umask 077
wg genkey | tee server.key | wg pubkey > server.pub

Keep private keys out of shell history, backups shared with others, and public repositories. Generate a separate key pair for each client so access can be revoked individually.

Server configuration

Create /etc/wireguard/wg0.conf with restrictive permissions:

1
2
3
4
5
6
7
8
[Interface]
Address = 10.77.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.77.0.2/32

Enable IPv4 forwarding through a dedicated file under /etc/sysctl.d/, then apply it with sudo sysctl --system. Configure forwarding and source NAT using the firewall system already managed by the host—such as nftables or UFW—rather than mixing several persistent rule managers.

Permit only UDP port 51820 from the Internet. If the Raspberry Pi sits behind a router, forward that UDP port to its reserved LAN address.

Client configuration

1
2
3
4
5
6
7
8
9
10
[Interface]
Address = 10.77.0.2/32
PrivateKey = CLIENT_PRIVATE_KEY
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = vpn.example.com:51820
AllowedIPs = 10.77.0.0/24
PersistentKeepalive = 25

The example uses split tunneling for the VPN subnet. Use 0.0.0.0/0, ::/0 only when all client traffic is deliberately meant to traverse the server and IPv6 is configured correctly.

Start and enable the interface with the platform’s wg-quick system service, then inspect status with sudo wg show. Protect backups of private keys, keep the operating system patched, remove lost clients promptly, and verify local law and network policy before exposing the service.

+