homelab-wireguard-vpn

name	homelab-wireguard-vpn
description	WireGuard VPN server setup, peer configuration, key generation, split tunneling vs full tunnel routing, and remote access to a home network from mobile and laptop clients.
origin	community

Homelab WireGuard VPN

WireGuard is a fast, modern VPN protocol. It is the right choice for remote access to a home network — simpler to configure than OpenVPN and faster than most alternatives.

All configuration examples show common setups. Review each command — especially the iptables forwarding rules and key file permissions — before applying them to your system, and make changes in a maintenance window.

When to Use

• Setting up WireGuard server on a Raspberry Pi, Linux host, pfSense, or router
• Generating WireGuard keypairs and writing peer config files
• Configuring remote access from a phone or laptop to a home network
• Explaining split tunneling (route only home traffic) vs full tunnel (route all traffic)
• Troubleshooting WireGuard connections that will not come up
• Automating peer configuration generation for multiple clients

How WireGuard Works

Your phone (WireGuard client)
    │
    │  Encrypted UDP tunnel (port 51820)
    │
Your home router (WireGuard server — needs a public IP or DDNS)
    │
    Your home network (192.168.1.0/24, NAS, Pi, etc.)

Every device has a keypair (public + private key).
The server knows each client's public key.
The client knows the server's public key + endpoint (IP:port).
Traffic is encrypted end-to-end with no central server or certificate authority.

Server Setup (Linux)

# Install WireGuard
sudo apt update &&  apt install wireguard -y


  -p /etc/wireguard
 sh -c 
 sh -c 



  /etc/wireguard/wg0.conf << 
[Interface]
Address = 10.8.0.1/24              
ListenPort = 51820
PrivateKey = <paste_server_private_key_here>


PostUp   = iptables -A FORWARD -i wg0 -o eth0 -j ACCEPT
PostUp   = iptables -A FORWARD -i eth0 -o wg0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
PostUp   = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -o eth0 -j ACCEPT
PostDown = iptables -D FORWARD -i eth0 -o wg0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]

PublicKey = <phone_public_key>
AllowedIPs = 10.8.0.2/32

[Peer]

PublicKey = <laptop_public_key>
AllowedIPs = 10.8.0.3/32
EOF
  600 /etc/wireguard/wg0.conf





  |   /etc/sysctl.d/99-wireguard.conf
 sysctl --system


 wg-quick up wg0
 systemctl  wg-quick@wg0