If you run a home server, whether Nextcloud, a NAS, a development machine, or anything else, you need a way to reach it when you are not home. The wrong way is to expose it to the public internet. Open a port, point a domain at your home IP, and every bot on the planet starts knocking on your door.

The right way is a VPN. Not a commercial VPN that routes your traffic through someone else’s servers. A self-hosted VPN that creates a direct encrypted tunnel between your devices and your home network. Nothing exposed. Nothing public. No third party involved.

WireGuard is that VPN.

What WireGuard Is

WireGuard is an open source VPN protocol built into the Linux kernel. It is fast, simple, and auditable. The entire codebase is roughly 4,000 lines of code. For comparison, OpenVPN is over 100,000 lines. IPsec implementations are even larger. Smaller codebases are easier to audit, easier to verify, and have fewer places for bugs to hide.

WireGuard uses modern cryptography: Curve25519 for key exchange, ChaCha20 for encryption, Poly1305 for authentication, BLAKE2s for hashing. There are no configuration options for cipher suites. No negotiation. No legacy algorithms. You get the secure option because it is the only option.

How It Works

WireGuard creates an encrypted tunnel between two devices. Your home server is one end. Your phone, laptop, or tablet is the other. When you connect, all traffic to your home network flows through the tunnel. Your device acts as if it is on your home network. You can access Nextcloud, SSH into machines, reach any service running at home. From anywhere.

The connection is point-to-point. Your traffic goes directly from your device to your home server. No relay. No coordination server. No company in the middle routing your packets. The only infrastructure involved is your own.

No Third Party

Commercial VPN services route your traffic through their servers. You are trusting them not to log it, not to inspect it, and not to hand it over when asked. That is the same trust problem that makes cloud storage risky. You are replacing one middleman with another.

WireGuard runs on your hardware. You generate the keys. You configure the peers. You control both ends of the tunnel. There is no account to create. No service to sign up for. No company that knows when you connect, where you connect from, or what you access. The tunnel exists between your devices and nothing else.

What You Need at Home

WireGuard runs on a Linux machine in your house. This is the same machine you would run Nextcloud on. If you already have a home server set up, WireGuard installs on top of it. If you do not, here is what you need.

Hardware

Any computer that can stay on and connected to your home network. WireGuard by itself uses almost no resources. But if you are also running Nextcloud on the same machine, which is the recommended setup, you need a bit more.

Minimum specs

  • CPU: any dual-core processor from the last ten years. An Intel N100, an old Core i3, even an ARM chip like a Raspberry Pi 4. WireGuard encryption is fast on modern hardware. Nextcloud is not CPU-intensive for a household.
  • RAM: 4 GB minimum. 8 GB is comfortable if you are running Nextcloud with a database. WireGuard itself uses a few megabytes.
  • Storage: a 128 GB SSD for the operating system and applications. Add a separate larger drive for your actual files. A 1 TB or 2 TB external SSD or internal hard drive. Keep the OS drive and your data on separate drives so you can replace either without losing the other.
  • Network: Ethernet port. Gigabit preferred.

Hardware options

  • Mini PC: an Intel N100 or similar mini PC. Around $150-$200. Small, quiet, low power draw (10-15 watts). Tuck it next to your router and forget about it. This is the recommended option for most people.
  • Old desktop or laptop: any machine you already have. Free. Higher power draw than a mini PC but perfectly functional. A laptop has the bonus of a built-in battery backup.
  • Raspberry Pi: a Pi 4 (4 GB) or Pi 5 handles WireGuard and light Nextcloud use. Around $60-$80 for the board. Draws about 5 watts. Limited by USB storage speeds on older models.

Connect it to your router with an Ethernet cable. Wi-Fi works but wired is more reliable for a server that needs to be available around the clock.

Operating system

Ubuntu Server is the most straightforward choice if you are new to Linux. Download it from ubuntu.com, flash it to a USB drive, boot the machine from the USB, and follow the installer. Choose the minimal installation. You do not need a desktop environment. This is a server. It runs headless. No monitor needed after setup. You manage it over SSH from your regular computer.

Debian is the alternative for people who want a purely community-run distribution with no corporate backing. Ubuntu is based on Debian. The commands are nearly identical. Debian is leaner, has no telemetry opt-out during install (because there is no telemetry to begin with), and is maintained entirely by volunteers. If you want the cleanest foundation, Debian is it.

If you are already running Fedora or any other Linux distribution, WireGuard works on all of them. The commands below cover the major ones.

Static local IP

Your server needs a fixed IP address on your home network so your router always knows where to send traffic. Most routers assign dynamic IPs by default. You have two options:

  • DHCP reservation: log into your router’s admin panel and reserve a specific IP for your server’s MAC address. This is the easiest method and does not require changing anything on the server.
  • Static IP on the server: configure the server itself to use a fixed IP. On Ubuntu Server, this is done through Netplan configuration.

Either way, pick an IP outside your router’s DHCP range. Something like 192.168.1.200. This ensures your router never assigns that address to another device.

Installing WireGuard

SSH into your server from your regular computer and install WireGuard. If you are sitting in front of the server with a keyboard, that works too.

Ubuntu / Debian

sudo apt install wireguard

Fedora / RHEL

sudo dnf install wireguard-tools

Generate server keys

wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key
chmod 600 /etc/wireguard/server_private.key

Create the server config

Create /etc/wireguard/wg0.conf:

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <contents of server_private.key>

# Enable IP forwarding for clients
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Replace eth0 with your server’s network interface name. Check with ip route | grep default.

Start WireGuard

sudo systemctl enable --now wg-quick@wg0

WireGuard is running. It starts on boot automatically.

Port forwarding

You need to forward one UDP port on your router to your server. Port 51820 by default. Log into your router’s admin panel and forward UDP port 51820 to your server’s local IP address. This is the only port you expose. WireGuard silently drops any packet that does not come from a configured peer. Scanners and bots get no response. The port looks closed to anyone who does not have a valid key.

Adding Devices

Each device that connects to your home network needs a key pair and a config. Generate them on the server and transfer the config to the device.

Generate client keys

wg genkey | tee client_private.key | wg pubkey > client_public.key

Add the client to the server config

Add a [Peer] section to /etc/wireguard/wg0.conf:

[Peer]
PublicKey = <contents of client_public.key>
AllowedIPs = 10.0.0.2/32

Reload WireGuard:

sudo wg syncconf wg0 <(wg-quick strip wg0)

Create the client config

[Interface]
Address = 10.0.0.2/24
PrivateKey = <contents of client_private.key>
DNS = 10.0.0.1

[Peer]
PublicKey = <contents of server_public.key>
Endpoint = <your-home-public-ip>:51820
AllowedIPs = 10.0.0.0/24
PersistentKeepalive = 25

The AllowedIPs setting controls what traffic goes through the tunnel. 10.0.0.0/24 routes only traffic to your home network through WireGuard. Everything else goes through your normal connection. If you want all traffic routed through your home network, change it to 0.0.0.0/0.

Installing on Your Devices

macOS

brew install wireguard-tools

Or install the WireGuard app from the Mac App Store. Import the client config file and connect. The Mac App Store version provides a menu bar icon for quick connect and disconnect.

iOS

Install WireGuard from the App Store. The app is open source under the GPL-2.0 license. Source code on the official WireGuard Git repository. Import the config file or scan a QR code. The QR code method is the easiest way to get the config onto your phone.

Generate a QR code on your server:

sudo apt install qrencode
qrencode -t ansiutf8 < client.conf

Point your phone at the terminal. Done.

Android

Install WireGuard from Google Play or F-Droid. Open source under the GPL-2.0 license. Same setup. Import the config or scan the QR code.

Linux

sudo apt install wireguard-tools  # Ubuntu/Debian
sudo dnf install wireguard-tools  # Fedora

Copy the client config to /etc/wireguard/wg0.conf and connect:

sudo wg-quick up wg0

Windows

Download the WireGuard installer from the official website or install via winget:

winget install WireGuard.WireGuard

Import the config file and connect.

Dynamic Home IP

Most home internet connections have a dynamic IP address that changes periodically. Your client configs need your home’s public IP in the Endpoint field. If it changes, your clients cannot connect.

The simplest solution is a dynamic DNS service. Set up a hostname that always points to your current home IP. DuckDNS is free and requires no account beyond a GitHub or Google login for initial setup. Your router may have built-in dynamic DNS support for services like No-IP or DynDNS.

Use the hostname instead of an IP address in your client configs:

Endpoint = myhome.duckdns.org:51820

Open Source

WireGuard is licensed under GPL-2.0. The kernel module is part of the Linux kernel itself since version 5.6. The userspace tools and all client applications are open source. The protocol specification is public. The cryptographic primitives are well-studied standards. There is no proprietary component anywhere in the stack.

Jason Donenfeld wrote WireGuard and it was reviewed by the Linux kernel security team before being merged. Linus Torvalds publicly praised the codebase. It is one of the most thoroughly reviewed VPN implementations in existence.

The Principle

Remote access to your home network should not require trusting a third party. You should not need an account with a VPN company. You should not need a coordination server that knows when your devices connect. You should not route your traffic through someone else’s infrastructure.

WireGuard gives you a direct, encrypted tunnel between your devices and your home. You control both ends. No one else is involved. No one else can see your traffic. No one else even knows the tunnel exists.

Your network. Your tunnel. Your keys. No one else’s.

Resources