FlashPanel

WireGuard VPN ​

WireGuard is free, open-source VPN (virtual private network) software that is lighter and faster than familiar options such as OpenVPN or IPsec. With WireGuard installed on your server, you can:

  • Encrypt your connection on public Wi-Fi.
  • Browse the Internet using the server's IP address.
  • Reach services that are only open on the server's internal network.

Install WireGuard ​

  1. Open the server's Applications page and choose the Not Installed tab.
  2. Find WireGuard and click the Install button (download icon).
  3. In the install dialog, review the following fields:
    • Port: the UDP port WireGuard listens on (default 23854).
    • DNS provider: pick Cloudflare (default), Cloudflare for Families (blocks malware), Google Public DNS, Quad9 (blocks malicious domains), AdGuard DNS (blocks ads and trackers) or OpenDNS to fill in DNS 1 and DNS 2, or type your own servers (IPv4 or IPv6).
    • Allowed IPs: the IP ranges routed through the VPN, in CIDR notation such as 10.0.0.0/24 (separated by commas, tabs, or Enter). Leave the default 0.0.0.0/0, ::/0 to send all traffic through the VPN.
  4. Click Install.

The UDP port is opened in the server firewall automatically, as a rule with the comment WireGuard.

Alternatively, before WireGuard is installed, select WireGuard in the Explore group of the server menu and click the Install button (download icon) to open the same dialog.

TIP

If your VPS provider has its own firewall (security group, cloud firewall), open the UDP port you chose in step 3 there too so devices can connect.

Connect to WireGuard VPN ​

After installation, open VPN > WireGuard in the server menu. The page reads everything straight from the server, so clients added over SSH also show up. It shows:

  • Whether WireGuard is running, its UDP port, the DNS servers and the Allowed IPs given to new clients.
  • The clients (each client is a device allowed to connect) with their address in the VPN, the Last handshake (the last time the device talked to the server; a green dot means it is connected now) and the Transfer since WireGuard last started. The page refreshes every 30 seconds.
  • The WireGuard service management buttons at the top right.

Create a WireGuard client ​

  1. Click the Create Client button.
  2. Enter a Name for the client (for example the device name: letters, numbers, dashes and underscores, up to 15 characters) and click Create Client.

The new client appears in the list and gets the next free address in the VPN. At the end of each row there are buttons:

  • View Config (QR code icon): show the client's configuration file and its QR code.
  • Download (download arrow): download the client's .conf configuration file.
  • Delete (trash icon): delete the client. Devices using this configuration can no longer connect.

TIP

Create a separate client for each device. If a device is lost, you only need to delete its client.

Install the WireGuard app ​

Download the WireGuard app for your device (Windows, macOS, Linux, Android, iOS) from the WireGuard installation page.

Import the WireGuard client configuration ​

On a phone, the quickest way is the QR code: click View Config on the client's row, then in the WireGuard app tap + and choose to scan a QR code.

To import the file instead:

  1. Open the WireGuard app.
  2. On a computer: click Import tunnel(s) from file and choose the downloaded .conf file. On a phone: tap the + button, choose to import from a file (Import from file or archive), and choose the .conf file.
  3. Confirm if the app asks for permission to add a VPN configuration.
  4. Click Activate (or turn on the switch on a phone) to connect.

To check, visit a website that shows your IP address. With the default Allowed IPs (0.0.0.0/0, ::/0), all traffic goes through the VPN, so the IP shown is the server's IP.

WARNING

The configuration file and its QR code contain the private key of the client. Anyone who has them can connect to your VPN, so do not share them; if one leaks, delete the client and create a new one.