Here's a guide on how to create your own no-log vpn with Wireguard

Prerequisites:
an offshore VPS with a dedicated static IPv4 address, running Linux (debian, ubuntu, any really)
(personally, I use rdp.sh)

SERVER
Install wireguard management tools:
apt install wireguard

Uncomment this line in /etc/sysctl.d/99-sysctl.conf
net.ipv4.ip_forward=1

Run the command to apply the change:
sysctl -w net.ipv4.ip_forward=1

CLIENT
Install Wireguard on your machine. On Arch/Fedora, it's wireguard-tools
Create public and private keys:
sudo bash -c "umask 077 ; wg genkey > /etc/wireguard/client_priv.key"
sudo bash -c "wg pubkey < /etc/wireguard/client_priv.key > /etc/wireguard/client_pub.key"

SERVER
Generate the public and private keys for the server:
umask 077 ; wg genkey > /etc/wireguard/server_priv.key
wg pubkey < /etc/wireguard/server_priv.key > /etc/wireguard/server_pub.key

Create a Wireguard configuration file in /etc/wireguard/wg0.conf (edit wg0 to whatever)
Code:
[Interface]
Address = 172.16.0.1/24
ListenPort = 51820
PrivateKey = (server's private key goes here)

Firewall rules

PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]

Client #1 details

PublicKey = (client's public key goes here)
AllowedIPs = 172.16.0.2/32

A reminder to NOT USE "". It should be raw, e.g.
PublicKey = b1/fwqfchascAHW19cAWjg3190A/1AscZZgY=

Enable and start the Wireguard service:
systemctl enable --now [email protected]

CLIENT
Create another Wireguard config file in /etc/wireguard/myvpn.conf
Code:
[Interface]
Address = 172.16.0.2/24
PrivateKey = (client's private key goes here)

Set to your desired DNS server

DNS = 9.9.9.9

[Peer]
PublicKey = (server's public key goes here)

Endpoint (server) can be a domain name or IP address

Endpoint = (server's IP address goes here):51820

Traffic to route to server

AllowedIPs = 0.0.0.0/0, ::/0

Start Wireguard:
sudo wg-quick up myvpn

Edit

Pub: 07 Sep 2025 14:26 UTC

Views: 50