How to Set Up WireGuard VPN on a Debian 13 (Trixie) VPS from AVS ISP
Introduction
WireGuard is a fast, modern, and cryptographically secure VPN protocol built directly into the Linux kernel. Unlike heavier alternatives such as OpenVPN or IPSec, WireGuard\ is lightweight, simple to configure, and offers excellent performance — making it an ideal choice for securing traffic through your AVS ISP VPS.
Debian 13 "Trixie" (released August 9, 2025) includes native WireGuard support in its default repositories, so no backports or third-party sources are required.
Prerequisites
Before you begin, ensure you have:
- A Debian 13 (Trixie) VPS from AVS ISP
- Root or
sudoaccess to the server - A local machine to act as the WireGuard client (Linux, Windows, macOS, Android, iOS)
- UDP port 51820 open in your AVS ISP VPS firewall/security group
Step 1 — Update the System
Log in to your VPS via SSH and update all packages:
apt update && apt upgrade -y
Step 2 — Install WireGuard
WireGuard is available in the Debian 13 default repositories:
apt install -y wireguard wireguard-tools iptables
Verify the installation:
wg --version
Step 3 — Generate Server Keys
Set a strict umask to protect private key files, then generate the server key pair:
umask 077
wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub
View and save your keys:
cat /etc/wireguard/server.key # Server Private Key (keep secret!)
cat /etc/wireguard/server.pub # Server Public Key (share with clients)
Step 4 — Generate Client Keys
Generate a key pair for the first client directly on the server:
wg genkey | tee /etc/wireguard/client.key | wg pubkey > /etc/wireguard/client.pub
cat /etc/wireguard/client.key # Client Private Key
cat /etc/wireguard/client.pub # Client Public Key
Step 5 — Identify Your Network Interface
Find the name of your VPS's main network interface (commonly eth0 or enp1s0):
ip address show
Note the interface name — you'll need it in the next step.
Step 6 — Configure the WireGuard Server
Create the server configuration file:
nano /etc/wireguard/wg0.conf
Paste the following, replacing the placeholder values:
[Interface]
# Server's VPN IP address
Address = 10.8.0.1/24
# UDP port WireGuard listens on
ListenPort = 51820
# Paste your server PRIVATE key here
PrivateKey = <SERVER_PRIVATE_KEY>
# Enable IP forwarding and NAT when the tunnel starts
# Replace eth0 with your actual network interface (e.g., enp1s0)
PostUp = echo 1 > /proc/sys/net/ipv4/ip_forward; \
iptables -A FORWARD -i wg0 -j ACCEPT; \
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = echo 0 > /proc/sys/net/ipv4/ip_forward; \
iptables -D FORWARD -i wg0 -j ACCEPT; \
iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
# ── Peer (Client) ──────────────────────────────────────────
[Peer]
# Paste your client PUBLIC key here
PublicKey = <CLIENT_PUBLIC_KEY>
# VPN IP assigned to this client
AllowedIPs = 10.8.0.2/32
Save and close (Ctrl+O, Enter, Ctrl+X).
Step 7 — Enable IP Forwarding Persistently
Edit /etc/sysctl.conf to make IP forwarding permanent across reboots:
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p
Step 8 — Start and Enable WireGuard
Start the WireGuard service and enable it at boot:
systemctl start wg-quick@wg0
systemctl enable wg-quick@wg0
Verify the interface is up:
wg show
ip address show wg0
You should see the wg0 interface with the address 10.8.0.1.
Step 9 — Configure the Client
On your client machine, create a WireGuard configuration file
(e.g., wg0.conf or import into the WireGuard app):
[Interface]
# Client's VPN IP
Address = 10.8.0.2/32
# Client PRIVATE key (generated in Step 4)
PrivateKey = <CLIENT_PRIVATE_KEY>
# Optional: Use the VPS as your DNS resolver
# DNS = 10.8.0.1
[Peer]
# Server PUBLIC key (from Step 3)
PublicKey = <SERVER_PUBLIC_KEY>
# Your AVS ISP VPS public IP and WireGuard port
Endpoint = <YOUR_VPS_PUBLIC_IP>:51820
# Route ALL traffic through the VPN
# For split tunnel (only VPN subnet), use: 10.8.0.0/24
AllowedIPs = 0.0.0.0/0, ::/0
# Keep the connection alive through NAT firewalls
PersistentKeepalive = 25
Bring up the client tunnel:
# Linux client
wg-quick up wg0
For Windows / macOS / Android / iOS, import the config file or QR code into the official WireGuard app.
Step 10 — Open the Firewall Port
If your AVS ISP VPS has a local ufw or iptables firewall, allow UDP port 51820:
# Using ufw
ufw allow 51820/udp
ufw reload
# Using iptables directly
iptables -A INPUT -p udp --dport 51820 -j ACCEPT
Also verify the port is open in the AVS ISP control panel under your VPS firewall/security group settings.
Step 11 — Verify the Connection
On the client, bring up the tunnel and test connectivity:
wg-quick up wg0
ping 10.8.0.1 # Ping the VPN server gateway
curl https://ifconfig.me # Should return your AVS ISP VPS public IP
On the server, confirm active peer sessions:
wg show
You should see the peer listed with a recent latest handshake timestamp.
Adding More Clients
For each additional client, repeat Steps 4 and 9, then add a new [Peer]
block to /etc/wireguard/wg0.conf on the server:
[Peer]
PublicKey = <NEW_CLIENT_PUBLIC_KEY>
AllowedIPs = 10.8.0.3/32
Reload WireGuard without dropping existing connections:
wg addconf wg0 <(wg-quick strip wg0)
# or restart the service
systemctl restart wg-quick@wg0
Useful Commands
| Action | Command |
|---|---|
| Show tunnel status | wg show |
| Start the tunnel | systemctl start wg-quick@wg0 |
| Stop the tunnel | systemctl stop wg-quick@wg0 |
| Restart the tunnel | systemctl restart wg-quick@wg0 |
| View WireGuard logs | journalctl -u wg-quick@wg0 -f |
| Check kernel module | lsmod | grep wireguard |
Security Tips
- Never share your private keys. Only exchange public keys between peers.
- Restrict SSH access to a specific IP or use key-based authentication only.
- Consider changing the default WireGuard port (51820) to a non-standard UDP port
to reduce noise from port scanners.
- Rotate key pairs periodically for long-running deployments.
- Use
PersistentKeepalive = 25on clients behind NAT to prevent session drops.
Guide written for AVS ISP VPS customers running Debian 13 "Trixie". WireGuard® is a registered trademark of Jason A. Donenfeld.