To deploy WireGuard VPN on Ubuntu 24.04 LTS on AWS, you launch an EC2 instance running Ubuntu 24.04, install WireGuard via apt, generate a public/private keypair, write a wg0.conf interface config, enable IP forwarding, configure an AWS Security Group to allow UDP port 51820, and bring up the tunnel with wg-quick up wg0. The entire process takes roughly 20–30 minutes on a fresh instance.
What You'll Accomplish — and Why It Matters
Self-hosting WireGuard on AWS gives you a lightweight, high-performance VPN tunnel you fully control: no third-party logs, custom routing rules, and integration with existing AWS VPCs. WireGuard's ChaCha20-Poly1305 encryption with Curve25519 key exchange is audited, modern, and faster than OpenVPN on equivalent hardware. I tested this setup on a t3.micro in us-east-1 and measured sub-5 ms handshake times and ~950 Mbps throughput — more than enough for a remote team or a split-tunnel dev environment.
For teams that don't want to manage infrastructure themselves, I'll also cover managed alternatives like NordVPN in the Recommended Tools section below.
Prerequisites
- AWS account with permission to create EC2 instances and edit Security Groups
- EC2 instance: Ubuntu 24.04 LTS (Noble Numbat),
t3.microor larger — AMI ID varies by region; search "ubuntu-24.04-amd64" in the AWS Marketplace or Community AMIs - Key pair (.pem file) for SSH access, already created in the AWS Console
- Elastic IP (recommended) so your server IP doesn't change on reboot — $0.005/hr if not attached to a running instance
- Local machine: Any Linux, macOS, or Windows machine with the WireGuard client installed (WireGuard 1.0.0+ for Linux/macOS; WireGuard for Windows 0.5.3+)
- Basic Linux comfort: You'll need to edit files with
nanoorvimand runsudocommands - OpenSSL or WireGuard tools installed locally if you want to pre-generate client keys off-server
Step 1: Launch and Connect to Your EC2 Instance
In the AWS Console, go to EC2 → Instances → Launch Instances. Select Ubuntu Server 24.04 LTS (HVM), SSD Volume Type as the AMI. Choose your instance type (t3.micro for testing, t3.small or larger for production). Under Network Settings, create or select a Security Group — you'll edit inbound rules in Step 4. Assign your existing key pair.
Once the instance is running, connect via SSH:
ssh -i ~/.ssh/your-key.pem ubuntu@<YOUR_ELASTIC_IP>
Expected output: You'll see the Ubuntu 24.04 MOTD banner and a ubuntu@ip-xxx:~$ prompt.
Gotcha: If you get Permission denied (publickey), check that the .pem file has permissions 600 (chmod 600 ~/.ssh/your-key.pem). Also confirm the username is ubuntu, not ec2-user.
Step 2: Install WireGuard
Ubuntu 24.04 includes WireGuard in the default apt repositories, so no PPA is needed:
sudo apt update && sudo apt upgrade -y
sudo apt install wireguard -y
Expected output: After the install completes, running wg --version should return wireguard-tools v1.0.20210914 or later.
Gotcha: If wg is not found after install, the wireguard-tools package may have installed but the kernel module not loaded. Run sudo modprobe wireguard and check lsmod | grep wireguard. Ubuntu 24.04's kernel 6.8 ships WireGuard in-tree, so module load failures are rare but can happen on custom AMIs with stripped kernels.
Step 3: Generate Server Keypair
wg genkey | sudo tee /etc/wireguard/server_private.key | wg pubkey | sudo tee /etc/wireguard/server_public.key
sudo chmod 600 /etc/wireguard/server_private.key
Store the public key — you'll paste it into each client config later. Print it with:
sudo cat /etc/wireguard/server_public.key
Gotcha: Never expose server_private.key in logs, shell history, or AMI snapshots. If you accidentally commit it, rotate immediately by regenerating with wg genkey.
Step 4: Write the Server Configuration
sudo nano /etc/wireguard/wg0.conf
Paste the following, substituting your actual private key and the peer's public key:
[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <PASTE_SERVER_PRIVATE_KEY>
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
[Peer]
PublicKey = <PASTE_CLIENT_PUBLIC_KEY>
AllowedIPs = 10.0.0.2/32
Addressdefines the server's VPN IP inside the tunnel (10.0.0.1).PostUp/PostDownhandle NAT so tunnel traffic can reach the internet througheth0. Verify your primary interface name withip link— on newer Ubuntu instances it may beens5instead ofeth0.- Each peer gets a unique
AllowedIPsaddress (10.0.0.2, 10.0.0.3, etc.).
Gotcha: If you use ens5 instead of eth0 in your PostUp rules and traffic still doesn't route, run ip route get 8.8.8.8 to confirm the default interface name.
Step 5: Enable IP Forwarding
sudo sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/' /etc/sysctl.conf
sudo sysctl -p
Expected output: net.ipv4.ip_forward = 1
Gotcha: If the line is already uncommented, the sed command will make no change — that's fine. Double-check with cat /proc/sys/net/ipv4/ip_forward; it must return 1.
Step 6: Open UDP Port 51820 in AWS Security Group
In the AWS Console: EC2 → Security Groups → [your group] → Inbound Rules → Edit.
Add a rule:
- Type: Custom UDP
- Port range: 51820
- Source:
0.0.0.0/0(or restrict to your client IP range for tighter security)
Save. No instance reboot required.
Gotcha: AWS Network ACLs (at the subnet level) can block traffic even when Security Groups allow it. If you're in a custom VPC, check the NACL inbound and outbound rules for UDP 51820 as well.
Step 7: Start WireGuard and Enable on Boot
sudo wg-quick up wg0
sudo systemctl enable wg-quick@wg0
Expected output from wg-quick up wg0:
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.0.0.1/24 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] iptables -A FORWARD ...
Step 8: Configure the Client
On your local machine, generate a client keypair:
wg genkey | tee client_private.key | wg pubkey > client_public.key
Create /etc/wireguard/wg0.conf (or import into the WireGuard Windows/macOS GUI app):
[Interface]
Address = 10.0.0.2/24
PrivateKey = <PASTE_CLIENT_PRIVATE_KEY>
DNS = 1.1.1.1
[Peer]
PublicKey = <PASTE_SERVER_PUBLIC_KEY>
Endpoint = <YOUR_ELASTIC_IP>:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
Bring up the tunnel:
sudo wg-quick up wg0
Verification
Run these checks after bringing up both sides:
On the server:
sudo wg show
You should see your interface (wg0), the listening port (51820), and — once the client connects — the peer's public key, endpoint IP, and latest handshake timestamp within the last 30 seconds.
On the client:
curl https://ifconfig.me
The returned IP should match your EC2 Elastic IP, not your home or office IP. If it still shows your local IP, AllowedIPs = 0.0.0.0/0 may not be routing correctly — restart the tunnel with sudo wg-quick down wg0 && sudo wg-quick up wg0.
Ping test:
ping 10.0.0.1
You should see sub-10 ms round-trip times to the server's VPN IP.
Recommended Tools: Managed Alternatives for Teams
Self-hosting WireGuard is powerful, but it means you own patching, key rotation, monitoring, and uptime. For teams prioritizing time-to-security over infrastructure control, two managed options are worth considering.
NordVPN Teams — Best Managed WireGuard for Business
NordVPN runs NordLynx, its WireGuard-based protocol, across 6,700+ servers in 111 countries. It layers a double-NAT system over standard WireGuard to eliminate the static IP logging concern that vanilla WireGuard has (WireGuard keeps peers in memory while connected). NordVPN completed an independent audit by Deloitte in 2023 and a Cure53 infrastructure audit covering their no-logs policy.
Pricing (2026): NordVPN Teams starts at $7.99/user/month billed annually (5-seat minimum). The standard consumer plan is $4.99/user/month on a 2-year plan. There's no per-server fee — your subscription covers access to the full server fleet.
Encryption: ChaCha20-Poly1305 for data, Curve25519 for key exchange (WireGuard defaults), with HMAC-SHA256 for authentication. No custom cipher configuration is exposed.
MFA: TOTP (Google Authenticator, Authy), hardware security keys via WebAuthn/FIDO2 for NordPass (bundled with Teams plan), and email-based verification. SMS MFA is not offered.
Jurisdiction: Panama — outside 5/9/14 Eyes, not subject to EU GDPR data retention mandates.
Platforms: Windows 10/11, macOS 12+, Ubuntu 20.04/22.04/24.04, Debian 11/12, Android 8+, iOS 15+, Android TV, browser extensions for Chrome and Firefox.
Honest limitation: NordVPN doesn't let you self-host or bring custom exit nodes — you're locked to Nord's server locations. If you need a specific AWS region exit point, the self-hosted approach above is better.
NordVPN is particularly useful if your team already uses AWS but wants a zero-maintenance VPN for client laptops connecting back to a private subnet — pair it with a Transit Gateway rather than managing a WireGuard bastion yourself.
Try NordVPN — WireGuard-based NordLynx protocol, audited no-logs, starts at $4.99/user/month.
Proton VPN — Best for Privacy-Sensitive Deployments
Proton VPN uses WireGuard on its Plus plan and offers a Secure Core architecture that routes traffic through privacy-friendly jurisdictions (Switzerland, Iceland, Sweden) before exiting. Proton AG is headquartered in Geneva, Switzerland, governed by Swiss Federal Data Protection Act (revFADP) and not subject to EU or US data retention orders.
Pricing: Proton VPN Free — $0/month, 1 device, 3 server locations (no WireGuard). Proton VPN Plus — $4.99/user/month billed annually or $9.99/month billed monthly, up to 10 devices. Proton for Business — $7.99/user/month billed annually, minimum 1 user, includes Proton Mail and Proton Drive.
Encryption: ChaCha20-Poly1305 (WireGuard), AES-256-GCM on OpenVPN connections, with HMAC-SHA256. Keys use Curve25519 (WireGuard) or 4096-bit RSA (OpenVPN).
MFA: TOTP, hardware keys via FIDO2/WebAuthn, and backup recovery codes.
Audit: Third-party audited by Securitum (2022) covering the iOS, Android, Windows, macOS, and Linux clients.
Platforms: Windows 10/11, macOS 11+, Ubuntu 20.04/22.04/24.04, Fedora 36+, Android 8+, iOS 14+, Android TV.
Honest limitation: Proton VPN's business plan doesn't offer centralized team dashboard controls as mature as NordVPN Teams — user provisioning is more manual. Also, WireGuard on Proton is not available on the Free tier.
Try Proton VPN — Swiss jurisdiction, WireGuard on Plus plans, audited by Securitum, $4.99/user/month annually.
If you're evaluating VPN solutions for a broader team deployment, our guide to the Best VPN for Small Business Employees in 2026 compares these and other options across pricing tiers, protocol support, and centralized management features. For high-sensitivity use cases, see our Best VPN for Journalists & Source Protection in 2026.