Setting up WireGuard on a VPS to route all mobile traffic requires configuring the server as a gateway and enabling IP forwarding on the host. You must define peers with specific allowed IPs, set up NAT masquerading for outgoing packets, and ensure your client devices use the correct DNS and route settings. This guide covers the essential Linux commands and configuration files needed for a secure, full-tunnel VPN experience.
Server Prerequisites and Installation
Before configuring the tunnel, ensure your VPS is running a modern kernel that supports WireGuard natively. Most Debian-based or Red Hat-based distributions include the necessary modules. Install the package using your system's package manager. For example, on Ubuntu or Debian, run
sudo apt install wireguard. On CentOS or RHEL, use
sudo yum install wireguard-tools.
Once installed, generate the key pair for the server. Navigate to the configuration directory and create keys securely. The command
wg genkey | sudo tee /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key creates both files. Set strict permissions on these files so only root can read them, ensuring the private key remains secret. This step is critical for the security of your entire network infrastructure.
Configuring the Server Interface
Create the main configuration file at
/etc/wireguard/wg0.conf. Define the interface section with the private key you generated earlier. Choose an arbitrary port, typically between 51820 and 51830, for the UDP endpoint. It is best practice to avoid hardcoding the public IP in the ListenPort section if possible, but specifying the address helps clarify the binding.
The core of the configuration lies in the Peer sections. Each mobile client needs its own peer entry. Generate a public key for each client device. In the peer block, specify the
PublicKey, the client's
PresharedKey (optional but recommended for extra security), and most importantly, the
AllowedIPs. To route all traffic through the VPN, set
AllowedIPs = 0.0.0.0/0, ::/0. This tells the server to accept all incoming traffic from this peer destined for any IP address. Also, configure the
Endpoint if you want the server to initiate connections, though for mobile clients behind NAT, this is usually left empty or set to
0.0.0.0:0.
For more details on managing multiple peers and troubleshooting connectivity issues between them, you might find
Troubleshooting WireGuard Client-to-Client Communication Issues helpful. Understanding how peers interact prevents common routing loops and access denials.
Enabling IP Forwarding and NAT
A standard VPN setup only routes traffic within the virtual network. To allow mobile clients to access the public internet through the VPS, you must enable IP forwarding. Edit the sysctl configuration file, usually located at
/etc/sysctl.conf, and uncomment or add the line
net.ipv4.ip_forward=1. Apply this change immediately by running
sudo sysctl -p. Without this setting, packets will be dropped by the kernel because it refuses to act as a router.
Next, configure Network Address Translation (NAT) so that return traffic from the internet is correctly routed back to the mobile clients. Use iptables or nftables to masquerade the traffic. If you are using iptables, the command
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE replaces the source IP of outgoing packets with the VPS's public IP. Replace
eth0 with your actual external network interface name, which you can verify using
ip link. Ensure this rule persists across reboots by saving your firewall rules appropriately for your distribution.
If you encounter issues where peers cannot see each other or traffic stops flowing unexpectedly, check our guide on
Wireguard Peer Not Accessible Troubleshooting Guide to diagnose packet filtering problems.
Client Configuration for Mobile Devices
On your mobile device, install the official WireGuard application available for iOS and Android. Create a new tunnel and import the configuration. The client config requires the server's public key, the server's IP address and port, and the client's private key. Crucially, set
AllowedIPs = 0.0.0.0/0, ::/0 on the client side as well. This ensures that all internet traffic from your phone is encrypted and sent to the VPS.
Set the
DNS field in the client configuration to your preferred resolver, such as
1.1.1.1 or
8.8.8.8. While some systems use DHCP to assign DNS, explicitly setting it in WireGuard prevents DNS leaks if the connection drops momentarily. Enable "Persistent Keepalive" with a value like
25 seconds. This sends a small packet every 25 seconds to keep the NAT mapping open on your mobile carrier's network, preventing the connection from timing out when idle.
Testing and Verification
Start the service on the server with
sudo systemctl start wg-quick@wg0 and enable it to start on boot. Verify the status using
wg show. You should see the handshake count increasing for your connected peers. On your mobile device, connect to the tunnel and visit a site like
ifconfig.me to verify that your public IP has changed to your VPS's IP address.
Check for DNS leaks by visiting
dnsleaktest.com. If the results show your ISP's DNS servers instead of the ones configured in WireGuard, your client settings may need adjustment. Ensure that no other apps on your mobile device are bypassing the VPN, which can happen on some Android versions if split tunneling is enabled by default.
For scenarios involving complex routing setups where you need to SSH into the server while maintaining a VPN, refer to
SSH to Wireguard server while router running Wireguard client VPN for advanced interface management tips.
Frequently Asked Questions
Why is my mobile device unable to access the internet after connecting?
This is usually caused by missing NAT rules or disabled IP forwarding on the server. Verify that
net.ipv4.ip_forward=1 is active in sysctl and that your iptables masquerade rule targets the correct external interface. Restart the WireGuard service after making changes to apply the new routing tables.
Can I use WireGuard to route only specific websites through the VPN?
Yes, by modifying the
AllowedIPs field in both the server and client configurations. Instead of
0.0.0.0/0, specify the subnet ranges of the services you wish to route. This technique, known as split tunneling, allows local traffic to bypass the VPN while sensitive data goes through the encrypted tunnel.
How do I prevent DNS leaks on my mobile device?
Explicitly define the
DNS parameter in your WireGuard client configuration file. Avoid relying on the operating system's default DNS resolution, as some mobile OS versions may ignore VPN-specified DNS during brief disconnections. Using reliable public resolvers like Cloudflare or Google reduces the risk of leaking queries to your ISP.
What happens if my VPS loses its internet connection?
If the VPS loses connectivity, all mobile clients dependent on it for internet access will lose their connection as well. Since the VPS acts as the gateway, there is no failover mechanism built into standard WireGuard. You should monitor the server's health and consider having a backup VPS ready if high availability is critical for your workflow.
Is it safe to store the private key on my mobile device?
Yes, provided you protect your device with a strong lock screen password or biometric authentication. The private key is stored locally within the WireGuard app's secure storage area. Do not share this key publicly or commit it to version control systems, as anyone with the key can impersonate your device and access the network.