Home Technical Create a VPN Server on your VPS

Create a VPN Server on your VPS

Last updated on Aug 28, 2026

If you need to create a VPN server on your VPS, please follow this instructions (This instruction is based on Ubuntu OS):

Create a WireGuard VPN server:

  1. Connect to Your VPS:

    Please see this help article to know how to connect to your VPS by SSH: https://help.servers.guru/hc/help-center/articles/1787555500-how-to-ssh-to-your-vps

  2. Install WireGuard:

    Install the WireGuard VPN app on your vps with this command:


    sudo apt update && sudo apt install -y wireguard

  3. Generate Server Keys:

    Generate the Server Keys with this commands:


    umask 077

    wg genkey | tee /etc/wireguard/privatekey

  4. Enable IPv4 Forwarding:

    Edit /etc/sysctl.conf and uncomment or add:


    net.ipv4.ip_forward=1

  5. Apply the change:


    sudo sysctl -p

  6. Create Server Configuration:


    sudo nano /etc/wireguard/wg0.conf

  7. Paste this code snipet to the file, replace <SERVER_PRIVATE_KEY> with the Server key that was generated above and replace eth0 with your server's primary network interface name, found via ip addr command:


    [Interface]

    PrivateKey = <SERVER_PRIVATE_KEY>

    Address = 10.0.0.1/24

    ListenPort = 51820

    PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

    PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

  8. Start WireGuard & Enable on Boot:


    sudo systemctl enable --now wg-quick@wg0

  9. Allow Port in Firewall:


    sudo ufw allow 51820/udp

  10. Setup a WGDashboard:


    Setup a web-based GUI to add, monitor, and manage clients via QR codes:

    • Install dependencies and clone WGDashboard:


      sudo apt update

      sudo apt install net-tools git python3-pip -y

      git clone https://github.com/WGDashboard/WGDashboard.git

      cd WGDashboard/src

    • Run the installation script:


      chmod +x wgd.sh

      ./wgd.sh install

    • Start the dashboard service:


      ./wgd.sh start

    • Allow the dashboard port through your firewall:

      sudo ufw allow 10086/tcp

    • Access the Web Dashboard:


      Navigate to http://YOUR_VPS_IP:10086 in your browser. Log in using the default credentials (admin/admin) to manage, create, and download client configurations visually.

  11. How to Use WGDashboard

    Once WGDashboard is up and running, you can manage your WireGuard server, create user profiles, and connect your client devices directly through the browser interface.

    • Creating a New Client Peer

      • Open Configuration Details: Click on your WireGuard interface (e.g., wg0).

      • Add Peer: Click the + Peer button.

      • Configure Peer Settings:

        • Name: Give the client a recognizable label (e.g., John-Phone or Work-Laptop).

        • Keys & IPs: WGDashboard automatically generates a unique Key Pair and assigns the next available internal IP address (e.g., 10.0.0.2/32).

        • Endpoint Allowed IPs: Ensure this is set to 0.0.0.0/0, ::/0 to route all internet traffic through the VPN server.

        • DNS: Set to a fast public resolver such as 1.1.1.1 or 8.8.8.8.

      • Save: Click Save to apply the configuration. The changes are pushed to WireGuard in real-time without interrupting active users.

    • Connecting Your Device

      • For Mobile Devices (iOS / Android):

        • Click the QR Code icon next to your newly created peer entry.

        • Open the WireGuard app on your smartphone, tap +, select Scan QR Code, and scan the code on your screen.

      • For Desktop Devices (Windows / macOS / Linux):

        • Click the Download File icon next to the peer to download the .conf configuration file.

        • Open the WireGuard Desktop App, click Add Tunnel, choose the downloaded file, and click Activate.

Create a OpenVPN VPN server:

  1. Quick install (using the official install script ):

    curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh

    chmod +x openvpn-install.sh

    ./openvpn-install.sh install

  2. The script will walk you through prompts:

    • Public IPv4 address (auto-detected, usually just confirm)

    • Protocol (UDP recommended for performance; TCP if UDP is blocked on your network)

    • Port (default 1194, or choose a custom one)

    • DNS resolver for clients (Cloudflare, Google, etc.)

    • Client name (creates your first .ovpn config file)

  3. After install, your client config file will be saved in your home directory, e.g.:

    /root/client.ovpn

  4. Download this file (via SFTP) and import it into your OpenVPN client app (available for Windows, macOS, Linux, iOS, Android).

  5. To add more clients later: ./openvpn-install.sh install

  6. Re-run the script and select "Add a new user."

Create a VLESS VPN server:

VLESS with Reality is a modern, harder-to-detect protocol, well suited for bypassing restrictive network filtering. The easiest way to set it up is via a panel like Marzban or 3x-ui, rather than configuring Xray manually.

  1. Quick install using 3x-ui (includes a web panel):

    bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)

  2. Follow the setup prompts:

    • Database Selection: You can choose between SQLite and PostgreSQL databases depending on your needs.

    • Customize Panel Port: You can type n to apply a random port or y to set a custom port.

    • Choose SSL certificate setup method: You can keep the default option or select another one based on your needs.

  3. After install, the script gives you:

    • A Panel Access URL (http://your_vps_ip:PORT)

    • An admin username/password (auto-generated)

  4. Inside the panel:

    • Log in via the panel URL (use the username and password that has been auto-generated in the previous step)

    • Go to Inbounds → Add Inbound

    • Remark: Enter a name for your connection (e.g., My-VLESS-VPN).

    • Choose protocol: VLESS

    • Security: Select REALITY.

    • Configure Reality Settings:

      • Target / SNI: Leave default or set to google.com:443

      • Keys: Click the Get New Cert button to auto-generate a new Private Key and Public Key set.

      • Click Create to save the inbound connection.

    • Go to Clients -> Add Clients

      • Insert the email of the client

      • Attached inbounds: Select all

      • Click Create.

    • Click the QR Code icon or copy the VLESS Link (vless://...) to your clipboard

    • Download a compatible VLESS client application on your target device:

      • Android: v2rayNG or NekoBox

      • iOS / macOS: FoXray, Streisand, or V2Box

      • Windows: v2rayN, Hiddify, or NekoBox

      • Linux: Hiddify or NekoBox

    • In your client app, select Import from Clipboard or scan the QR code to load your configuration, then activate the connection.

Create a PiVPN Server:

PiVPN was originally built for Raspberry Pi but works on any Debian/Ubuntu-based VPS. It offers a simpler, guided install than raw WireGuard/OpenVPN setup.

  1. Install:

    • Use this command to install PiVPN: curl -L https://install.pivpn.io | bash

    • The installer will prompt you to:

      • Choose a VPN type: WireGuard (recommended, faster/modern) or OpenVPN

      • Confirm your public IP

      • Choose a port (default WireGuard port: 51820)

      • Choose a DNS provider for clients

  2. After install, create a client profile:

    • Use this command to create a client profile: pivpn add

    • Enter the Client IP and Client Name: You can leave it default or setup by yourself.

    • This generates a .conf file (WireGuard) or .ovpn file (OpenVPN) for your device. (location of the file will be showed in the result of the command.)

    • You can setup the vpn connection by adding the configuration file to WireGuard or OpenVPN apps in your client devices.

    • To view/manage existing clients: pivpn list

    • To remove a client: pivpn revoke <client_name>