--- title: "How to Set Up a WireGuard Raspberry Pi VPN Server" description: "Learn how to use a WireGuard Raspberry PI VPN server and create a secure connection for outside your office in a compact package!" canonical: "https://adamtheautomator.com/wireguard-raspberry-pi/" --- # How to Set Up a WireGuard Raspberry Pi VPN Server > Learn how to use a WireGuard Raspberry PI VPN server and create a secure connection for outside your office in a compact package! Source: https://adamtheautomator.com/wireguard-raspberry-pi/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![How to Set Up a WireGuard Raspberry Pi VPN Server](https://adamtheautomator.com/wp-content/uploads/2023/01/wireguard-raspberry-pi.jpg) # How to Set Up a WireGuard Raspberry Pi VPN Server [![](https://secure.gravatar.com/avatar/2788bb1a3f735603f81eca51d68daec56a9d97e805a10268fb2c20afcc76b81b?s=192&d=mm&r=g)Nicholas Xuan Nguyen](https://adamtheautomator.com/author/nicholas-xuan-nguyen/)23 January 20237 min. read Categories: [IT Ops](/category/it-ops/), [Uncategorized](/category/uncategorized/) Tags:[Raspberry Pi](/tag/raspberry-pi/)[WireGuard](/tag/wireguard/) Table of Contents * [Prerequisites](#prerequisites) * [Installing WireGuard on Raspberry Pi](#installing-wireguard-on-raspberry-pi) * [Configuring a WireGuard Client Profile](#configuring-a-wireguard-client-profile) * [Connecting to the WireGuard Server](#connecting-to-the-wireguard-server) * [Conclusion](#conclusion) Are you tired of slow, insecure VPNs in your Raspberry PI that take forever to set up and leave your data exposed? Look no further, and start setting up WireGuard Raspberry Pi! In this tutorial, you will learn how to set up a high-speed, secure WireGuard VPN server on your Raspberry Pi with no complex stuff. Read on and say hello to lightning-fast, secure browsing on your devices! ## Prerequisites Before you begin this tutorial, you will need to have the following items at hand: * A Raspberry Pi with an operating system (OS) installed – This tutorial uses Raspberry Pi 4 with Raspian Buster installed. * A power supply for your Raspberry Pi. * An ethernet cable – The VPN server needs a stable internet connection to function properly. * A computer to access the Raspberry Pi remotely – This tutorial uses Windows with SSH installed. Related:[How to Set Up OpenSSH on Windows Server \[Complete Guide\]](https://adamtheautomator.com/openssh-windows/) * A client device with [WireGuard client installed](https://www.wireguard.com/install/) – This tutorial uses a Windows 10 client. ## Installing WireGuard on Raspberry Pi Utilizing state-of-the-art **[cryptography](https://www.wireguard.com/protocol/),** WireGuard is defined as a fast and modern VPN. But even though, WireGuard is cross-platform, it does not come preinstalled with your Raspberry Pi. You will need to first download and install the WireGuard package on your Raspberry Pi via the [PiVPN](https://pivpn.io/) script. This script is an automated installation and configuration tool that makes setting up a WireGuard server on the Raspberry Pi incredibly handy. Related:[How To Set Up WireGuard VPN on Linux](https://adamtheautomator.com/wireguard-vpn/) To install WireGuard on your Raspberry Pi using the PiVPN script, follow these steps: 1\. Plug your Raspberry Pi into the power supply and connect it to the internet via an ethernet cable. 2\. SSH into your Raspberry Pi, and run the following [`apt update`](https://linuxize.com/post/how-to-use-apt-command/#updating-package-index-apt-update) command to update the package list. This command ensures access to the latest software packages and helps resolve dependency issues. Related:[Learn How to Remotely Access Raspberry PI Devices](https://adamtheautomator.com/how-to-remotely-access-raspberry-pi/) ```bash sudo apt update -y ``` ![Updating the package list](https://adamtheautomator.com/wp-content/uploads/2023/01/image-259.png) Updating the package list Related:[Learning Ubuntu Apt Get Through Examples](https://adamtheautomator.com/ubuntu-apt-get/) 3\. Next, run the below `curl` command to view (`cat`) the script’s source code before you run it on your Raspberry Pi. Doing so ensures the script is secure and contains no malicious code. Related:[CURL Linux Command : Learning By Example](https://adamtheautomator.com/curl-linux/) ```bash curl -L https://install.pivpn.io | cat ``` ![Viewing the source code of the PiVPN script](https://adamtheautomator.com/wp-content/uploads/2023/01/image-260.png) Viewing the source code of the PiVPN script 4\. Now, run the following `curl` command to download and execute (`bash`) the latest version of the PiVPN script on your Raspberry Pi. The PiVPN Automated Installer pops up, where you will be asked questions regarding the setup of your WireGuard server (step five). No need to manually edit cumbersome configuration files. ```bash curl -L https://install.pivpn.io | bash ``` Hit the ENTER key to begin the installation process. ![Initiating installing WireGuard](https://adamtheautomator.com/wp-content/uploads/2023/01/image-261.png) Initiating installing WireGuard 5\. Hit ENTER to initiate the network interface. ![Initiating the network interface](https://adamtheautomator.com/wp-content/uploads/2023/01/image-262.png) Initiating the network interface 6\. Next, select **Yes** and press ENTER to force all IPv6 connections through the VPN. Doing so prevents the client from bypassing the tunnel and leaking its real IPv6 address to servers. This setting helps ensure all internet traffic, including IPv6 traffic, is securely transmitted through the VPN server rather than being sent directly to the internet. ![Routing IPv6 to block leakage](https://adamtheautomator.com/wp-content/uploads/2023/01/image-263.png) Routing IPv6 to block leakage 7\. After force routing IPv6, select **No** and press ENTER to choose setting up a static IP address. This tutorial will not be using [DHCP reservations](https://www.stephenwagner.com/2019/05/07/static-ip-vs-dhcp-reservation/) for simplicity. But if you prefer using this feature, select **Yes** and enter the IP address to assign to the router. ![Choosing to setup a static IP address](https://adamtheautomator.com/wp-content/uploads/2023/01/image-264.png) Choosing to setup a static IP address 8\. Next, choose Yes, and press ENTER to use your current network settings as a static address for your WireGuard server. ![Agreeing to use the current network settings as a static address](https://adamtheautomator.com/wp-content/uploads/2023/01/image-265.png) Agreeing to use the current network settings as a static address 9\. Hit ENTER to acknowledge the IP conflict warning. ![Acknowledging the IP conflict warning](https://adamtheautomator.com/wp-content/uploads/2023/01/image-266.png) Acknowledging the IP conflict warning 10\. Now, hit the ENTER key again to parse the local users’ list. ![Parsing local user list](https://adamtheautomator.com/wp-content/uploads/2023/01/image-267.png) Parsing local user list 11\. Select a user from the list, and press ENTER to allow the selected user of the following: * Use the OpenVPN client to connect to the VPN server.Access the network and internet through the VPN connection. ![Selecting the user allowed to use the OpenVPN client](https://adamtheautomator.com/wp-content/uploads/2023/01/image-268.png) Selecting the user allowed to use the OpenVPN client 12\. Select **WireGuard**, and press ENTER to configure your Raspberry Pi to use WireGuard as the VPN protocol. With this option, Raspberry Pi will use the WireGuard protocol to establish and maintain client VPN connections. ![Selecting WireGuard as the VPN protocol](https://adamtheautomator.com/wp-content/uploads/2023/01/image-269.png) Selecting WireGuard as the VPN protocol 13\. Keep the default port set to **51820**, and press ENTER. WireGuard uses this default port to establish VPN connections with clients. Doing so ensures your VPN server is compatible with most WireGuard clients configured to use port 51820 by default. But if you need to use a different port, avoid using well-known ports such as 22 (SSH), 443 (HTTPS), etc., to prevent conflicts with other services. ![Keeping the default port set to 51820](https://adamtheautomator.com/wp-content/uploads/2023/01/image-270.png) Keeping the default port set to 51820 14\. Now, select Google, and press ENTER to configure your Raspberry Pi to use the popular Google DNS servers as the DNS server. Google’s DNS service uses state-of-the-art technology and infrastructure to provide fast and secure DNS resolution. ![Selecting Google DNS servers](https://adamtheautomator.com/wp-content/uploads/2023/01/image-271.png) Selecting Google DNS servers 15\. Keep the default option select, which is the public IP the clients will use to connect to your server, and press ENTER. ![Selecting the public IP the clients will use to connect to the server](https://adamtheautomator.com/wp-content/uploads/2023/01/image-272.png) Selecting the public IP the clients will use to connect to the server 16\. When prompted, as shown below, press ENTER to confirm generating the server keys. WireGuard will use these cryptographic server keys to secure the VPN connection between the server and the clients. ![wireguard raspberry pi - Generating cryptographic server keys](https://adamtheautomator.com/wp-content/uploads/2023/01/image-273.png) Generating cryptographic server keys 17\. Press ENTER twice to enable the unattended-[upgrades](https://adamtheautomator.com/automatic-upgrades-in-ubuntu/) tool. This tool automatically installs security updates and other vital packages on a Linux system without user interaction. Related:[Staying Up-to-Date With Automatic Upgrades in Ubuntu](https://adamtheautomator.com/automatic-upgrades-in-ubuntu/) ![](https://adamtheautomator.com/wp-content/uploads/2023/01/image-274.png) Acknowledging period reboot requirement ![Enabling the unattended-upgrades tool](https://adamtheautomator.com/wp-content/uploads/2023/01/image-275.png) Enabling the unattended-upgrades tool 18\. Wait for the installation to finish and press ENTER twice when prompted to close the installer and reboot the WireGuard server. ![Finishing the installation ](https://adamtheautomator.com/wp-content/uploads/2023/01/image-276.png) Finishing the installation ![Rebooting the server](https://adamtheautomator.com/wp-content/uploads/2023/01/image-277.png) Rebooting the server 19\. SSH into the Pi again once it boots up, and run the command below to bring up the WireGuard interface. `wg-quick up wg0` ```bash wg-quick up wg0 ``` ![Bringing up the WireGuard interface](https://adamtheautomator.com/wp-content/uploads/2023/01/image-278.png) Bringing up the WireGuard interface 20\. Finally, run the command below to verify that the WireGuard interface is running. `sudo wg show` ```bash sudo wg show ``` If all goes well, you will get an output similar to the one below that shows the current state of the WireGuard interface. The output includes information about the listening port and the public and private keys. Typically, you will also see a list of peers of active connections. But since there are none, you will see an empty peer list. ![Verifying the WireGuard interface is running](https://adamtheautomator.com/wp-content/uploads/2023/01/image-279.png) Verifying the WireGuard interface is running ## Configuring a WireGuard Client Profile You have just verified your WireGuard server is running. But you still need a way to manage it. How? By configuring a client profile to connect to your server. Client profiles are specific configurations used to connect to the WireGuard server. Each profile contains information, such as the server’s IP address, private keys for the client, and other settings, such as allowed IPs, DNS servers, etc. Run the following `pivpn` command to `add` a new client profile. ```bash sudo pivpn add ``` When prompted, provide a name for the profile (i.e., **wgvpn**) and press ENTER. The PiVPN script will automatically generate the private key, configure the client config for the profile, and add the profile to the server configuration. If successful, you will see a success message, as shown below. ![Configuring a WireGuard client profile](https://adamtheautomator.com/wp-content/uploads/2023/01/image-280.png) Configuring a WireGuard client profile Now, run the below ls command to list the client profiles. ```bash ls -la configs ``` Below, you can see the newly-added profile in the list. ![Listing all client profiles](https://adamtheautomator.com/wp-content/uploads/2023/01/image-281.png) Listing all client profiles ## Connecting to the WireGuard Server After configuring your client profile, you can connect to your Raspberry Pi’s WireGuard server. But first, you will have to import your profile to the WireGuard client. To connect to your WireGuard server: 1\. Connect to your Raspberry Pi using SFTP via an FTP client like [FileZilla](https://filezilla-project.org/). 2\. Once connected, navigate to your client profile (_wgvpn_) in your Raspberry Pi, and [transfer the client profile](https://www.dexterindustries.com/howto/how-to-transfer-files-to-your-raspberry-pi-from-a-pc-computer/) to your Windows 10 computer. 3\. Launch your WireGuard client, click **Import tunnel(s) from file**, and locate the client profile on your Windows 10 computer to import. ![Importing a client profile](https://adamtheautomator.com/wp-content/uploads/2023/01/image-282.png) Importing a client profile 4\. Now, click **Activate** to initiate the VPN connection. The WireGuard client will establish a secure VPN connection to your WireGuard server running on your Raspberry Pi. ![](https://adamtheautomator.com/wp-content/uploads/2023/06/image-60.png) Initiating a VPN connection to the Raspberry Pi VPN server With an established connection, you will see an **Active** status, as shown below. You can now use the WireGuard client app to securely connect to your Raspberry Pi over the internet and enjoy secure private access to the VPN network. > _When you click the close button (top-right), the WireGuard client is minimized to the system tray to keep it running in the background._ ![Verifying the connection is to the Raspberry Pi has been established ](https://adamtheautomator.com/wp-content/uploads/2023/01/image-284.png) Verifying the connection is to the Raspberry Pi has been established If you are having trouble connecting to the WireGuard server, the cause is often related to your router’s port forwarding settings. Below are a few things you can check to troubleshoot connection issues:
TroubleshootingFix
Check your router’s port forwarding settingsIf you changed WireGuard’s default port (51820), configure the router’s port forwarding to allow traffic on the appropriate port. Ensure the port forwarding rule is configured correctly and is pointing to the correct IP address and port number for the WireGuard server.
Check your router firewallEnsure the router’s firewall is not blocking the VPN connection. You may need to add an exception or rule to allow VPN traffic through the firewall.
There are no one-size-fits-all solutions for troubleshooting connection issues, as each router is unique and may have different settings and configurations. A Google search for “port-forwarding” and the model of your router can often yield helpful results. 5\. Lastly, run the below command to check the list of peers. ```bash sudo wg show ``` This time, you will see the newly-connected client in the list, as shown below. ![Checking the list of peers](https://adamtheautomator.com/wp-content/uploads/2023/01/image-285.png) Checking the list of peers ## Conclusion Congratulations! You are now the proud owner of your own WireGuard Raspberry Pi VPN server! In this tutorial, you have realized that with just a few steps, you can set up a secure and private connection to the internet. At this point, protecting your online activity from prying eyes while gaining access to content that might be blocked in your region is within your reach. Continue exploring the possibilities of WireGuard on your Raspberry Pi! Why not use a [dynamic DNS service](https://dev.to/amelspahic/set-up-dynamic-dns-for-dynamic-ip-addresses-at-home-for-free-wireguard-configuration-381j) to give your Raspberry Pi a fixed domain name? Doing so helps if you do not have a static IP address and your IP address changes frequently. Make connecting to your WireGuard server easier from anywhere using a fixed domain name! Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fwireguard-raspberry-pi%2F&text=How%20to%20Set%20Up%20a%20WireGuard%20Raspberry%20Pi%20VPN%20Server)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fwireguard-raspberry-pi%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fwireguard-raspberry-pi%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2024/03/terragrunt.png) ### [Keeping Terraform Maintainable with Terragrunt](/terragrunt/) Discover Terragrunt and embrace the power to simplify Terraform workflows—Ensure maintainability and organization of your infrastructure today! ![](https://adamtheautomator.com/wp-content/uploads/2021/05/How-to-Partition-and-Erase-Windows-Volumes-with-Diskpartx.jpg) ### [Mastering Diskpart : Erase and Partition Volumes with Ease](/diskpart/) Learn how to create partitions, create volumes, delete volumes and partitions and manage unallocated space with the Windows Diskpart utility. ![](https://adamtheautomator.com/wp-content/uploads/2022/02/Network-Troubleshooting-from-the-Command-Line-with-TShark.jpg) ### [Network Troubleshooting from the Command-Line with TShark](/tshark/) Learn how to set up TShark on your machine to capture packets for effective network troubleshooting in this step-by-step tutorial! ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)