How to Set Up WireGuard VPN on a Contabo VPS: Fast & Secure Tunnel

Why Self-Host a WireGuard VPN on Contabo?

Commercial VPN providers can be expensive, and you never truly know if they are logging your browsing traffic. By hosting your own WireGuard VPN on a Contabo Cloud VPS, you retain complete privacy, route all traffic through a clean dedicated IP address, and take advantage of Contabo's generous 32 TB monthly bandwidth allowance across European or US data centers.

Step 1: Installing WireGuard Kernel Modules

WireGuard is included directly in the Linux kernel on Ubuntu 20.04 and newer. Install the tools package:

sudo apt update
sudo apt install -y wireguard iptables qrencode

Step 2: Generating Server and Client Cryptographic Keys

WireGuard uses Curve25519 public-key encryption. Generate keypairs for the server and first client:

# Set secure umask
umask 077

# Generate server keys
wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key

# Generate client keys
wg genkey | tee /etc/wireguard/client1_private.key | wg pubkey > /etc/wireguard/client1_public.key

Step 3: Creating Server Configuration (wg0.conf)

Identify your server's public network interface (typically eth0 or ens3 on Contabo):

ip -o -4 route show to default | awk '{print $5}'

Now create /etc/wireguard/wg0.conf (substitute your server private key and client public key):

sudo nano /etc/wireguard/wg0.conf

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <CONTENTS_OF_SERVER_PRIVATE_KEY>
SaveConfig = false

# Enable NAT IP Masquerading on your public interface (replace eth0 if different)
PostUp = ufw route allow in on wg0 out on eth0
PostUp = iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE
PostDown = ufw route delete allow in on wg0 out on eth0
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

# Client configuration
[Peer]
PublicKey = <CONTENTS_OF_CLIENT1_PUBLIC_KEY>
AllowedIPs = 10.8.0.2/32

Step 4: Enabling IPv4 Forwarding in the Kernel

Allow the Linux kernel to forward packets between the virtual WireGuard network interface and the Internet:

sudo nano /etc/sysctl.d/99-wireguard.conf

Add:

net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1

Apply immediately:

sudo sysctl -p /etc/sysctl.d/99-wireguard.conf

Step 5: Opening UDP Port 51820 & Starting Service

sudo ufw allow 51820/udp comment "WireGuard VPN Port"
sudo systemctl enable --now wg-quick@wg0
sudo wg show

Step 6: Generating Mobile/Desktop Client Profile

Create a configuration file for your phone or laptop:

nano ~/client1.conf

[Interface]
PrivateKey = <CONTENTS_OF_CLIENT1_PRIVATE_KEY>
Address = 10.8.0.2/24
DNS = 1.1.1.1, 1.0.0.1

[Peer]
PublicKey = <CONTENTS_OF_SERVER_PUBLIC_KEY>
Endpoint = YOUR_CONTABO_SERVER_IP:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

To connect a smartphone, generate a terminal QR code:

qrencode -t ansiutf8 < ~/client1.conf

Scan this QR code using the official WireGuard app on iOS or Android, and you are instantly connected to your private encrypted tunnel.

Frequently Asked Questions (FAQ)

Does WireGuard slow down Internet connection speeds?

Unlike OpenVPN which runs in user-space and consumes high CPU for AES encryption, WireGuard runs natively in the Linux kernel using ChaCha20-Poly1305, achieving near line-speed throughput with minimal battery drain on mobile devices.

Can I connect multiple devices simultaneously?

Yes. Simply generate a unique private/public keypair and assign a unique IP (e.g. 10.8.0.3/32) for each client peer in /etc/wireguard/wg0.conf.