Deploy your own private WireGuard VPN server in minutes — with a clean browser dashboard for managing clients, scanning QR codes, and watching live traffic. No config files. No command-line headaches.
wg-easy (WireGuard Easy) is a free, open-source tool that bundles a full WireGuard VPN server together with a web-based admin dashboard in a single Docker container. WireGuard itself is one of the fastest and most modern VPN protocols available, but managing it by hand means editing config files, generating key pairs, and running terminal commands for every new device.
wg-easy removes all of that friction. Once it's running, you open a browser, log in to the dashboard, and manage everything visually: create a client, scan its QR code with your phone, and you're connected. It's the go-to choice for homelab users, developers, and small teams who want a private, self-hosted VPN without becoming networking experts.
Because you host it yourself — on a cheap VPS or even a Raspberry Pi at home — you control the server, the logs, and the exit IP. Common uses include securely accessing your home network while traveling, protecting traffic on public Wi-Fi, and connecting remote teammates to internal services.
Create, edit, enable, disable, and delete VPN clients from a clean web interface — no terminal required after setup.
Each client gets an instant QR code. Scan it with the WireGuard mobile app and your phone is connected in seconds.
See which clients are connected right now, with transfer (Tx/Rx) charts and last-handshake times per device.
Ships as a single Docker image with WireGuard, the UI, and routing rules pre-configured. Works with Docker Compose and Podman.
Export a ready-made .conf file for any client to use on Windows, macOS, and Linux desktops.
Actively maintained open-source project with a large worldwide community. Your only cost is the server you run it on.
The full setup takes about five minutes on any Linux server with a modern kernel (5.6+). Here's the standard path used by most self-hosters:
Any VPS or home server running Linux works. Install Docker with the official convenience script, then log out and back in.
Newer versions of wg-easy use a bcrypt-hashed admin password for the web UI instead of plain text — remember to double every $ sign in the hash inside your compose file.
services:
wg-easy:
image: ghcr.io/wg-easy/wg-easy
container_name: wg-easy
environment:
# Your server's public IP or domain
- WG_HOST=YOUR_SERVER_IP
# bcrypt hash of your admin password ($ doubled)
- PASSWORD_HASH=YOUR_BCRYPT_HASH
volumes:
- etc_wireguard:/etc/wireguard
ports:
- "51820:51820/udp" # WireGuard tunnel
- "51821:51821/tcp" # Web UI
cap_add:
- NET_ADMIN
- SYS_MODULE
sysctls:
- net.ipv4.ip_forward=1
- net.ipv4.conf.all.src_valid_mark=1
restart: unless-stopped
volumes:
etc_wireguard:$ docker compose up -d
$ docker compose logs -f wg-easy # verify it's runningVisit http://YOUR_SERVER_IP:51821, log in, and click New Client. Scan the QR code with the WireGuard app or download the config file. Don't forget to forward UDP port 51820 on your router if hosting at home.
Put the web UI behind a reverse proxy (Caddy or Nginx) with HTTPS, use a strong admin password, and pull image updates regularly with docker compose pull.
Each approach has a place. This is how they compare for a typical self-hoster:
| Aspect | wg-easy | Manual WireGuard | Commercial VPN |
|---|---|---|---|
| Setup time | ~5 minutes | 30–60 minutes | Instant |
| Web admin UI | Yes | No | App only |
| You control the server & logs | Yes | Yes | No |
| Access your home/office LAN | Yes | Yes | No |
| QR code client setup | Built-in | Manual | Built-in |
| Monthly cost | Server only (~$4+) | Server only | $3–12 subscription |
| Skill required | Beginner | Advanced | None |
Everything you need to launch your own WireGuard VPN today. The starter files below are generated instantly in your browser — no sign-up required.
Ready-to-use Compose file with WireGuard ports, kernel capabilities, and volume mapping pre-configured. Just add your server IP and password hash.
A commented environment template covering the most useful wg-easy variables: host, ports, DNS, allowed IPs, and language settings.
A printable pre-flight checklist: server requirements, port forwarding, security hardening, and post-install verification steps.
Reach your NAS, smart-home dashboard, security cameras, or media server from anywhere in the world — as if you were sitting at home.
Route your phone and laptop traffic through your own encrypted tunnel at airports, cafés, and hotels, keeping snoopers out of your data.
Give teammates secure access to internal tools, staging servers, and databases without exposing anything to the public internet.
Browse with the IP address of your own server instead of a shared commercial VPN — useful for consistent access and fewer captchas.
Step-by-step tutorials covering installation, security hardening, Raspberry Pi setups, port forwarding, troubleshooting, and backups — everything you need to master your self-hosted VPN.
wg-easy is used to self-host a private WireGuard VPN with an easy web dashboard. Popular use cases: secure remote access to a home network or NAS, safe browsing on public Wi-Fi, connecting remote team members to internal tools, and routing traffic through your own trusted server.
Yes — wg-easy is 100% free and open source. Your only cost is the server it runs on, which can be a $4/month VPS or hardware you already own, like a Raspberry Pi.
Docker (or Podman) is the recommended way. The official image bundles WireGuard, the web UI, and all networking rules, so a single docker compose up -d gets you a working VPN.
The VPN tunnel uses WireGuard's modern cryptography, which is considered state of the art. The main thing to protect is the admin web UI: use a strong bcrypt-hashed password, serve it over HTTPS via a reverse proxy, avoid exposing it publicly if you don't need to, and keep the container updated.
Choose a commercial VPN if you mainly want to change your apparent location with zero setup. Choose wg-easy if you want to reach your own network remotely, control your own logs and exit IP, or avoid monthly VPN subscriptions.
Yes. wg-easy runs well on ARM devices like the Raspberry Pi and is available as a community app on NAS platforms such as TrueNAS. Anywhere Docker runs with a WireGuard-capable kernel, wg-easy can run.
In-depth, step-by-step guides for running your own WireGuard VPN with wg-easy — installation, security, troubleshooting, hardware, and maintenance.
A complete beginner-friendly walkthrough: from a fresh Linux server to a working VPN dashboard in under ten minutes, including password hashing.
Read guide → /blog/how-to-install-wg-easy-with-docker-compose/We compare setup time, flexibility, and maintenance effort so you can decide whether the web UI or raw config files fit your workflow better.
Read guide → /blog/wg-easy-vs-manual-wireguard/Never expose your admin panel over plain HTTP. Learn how to put Caddy or Nginx in front of wg-easy with free auto-renewing SSL certificates.
Read guide → /blog/secure-wg-easy-web-ui-with-https-reverse-proxy/Turn a Raspberry Pi into a 24/7 home VPN server. Covers ARM image support, performance expectations, and power-saving tips.
Read guide → /blog/run-wg-easy-on-raspberry-pi/Which port does what, which one to forward on your router, and which one you should never expose to the internet — explained with diagrams.
Read guide → /blog/wg-easy-port-forwarding-explained/Handshake failing? Connected but no internet? DNS not resolving? A practical checklist for the most frequent wg-easy issues and their fixes.
Read guide → /blog/fix-common-wg-easy-connection-problems/Your client keys live in one folder. Learn how to back it up automatically, and restore your full VPN on a new server in minutes.
Read guide → /blog/wg-easy-backup-and-restore-guide/Stream from your NAS, control smart devices, and reach your desktop remotely — a full walkthrough for the classic home VPN setup.
Read guide → /blog/access-home-network-anywhere-with-wg-easy/This guide takes you from a fresh Linux server to a fully working wg-easy VPN with a web dashboard. No prior WireGuard experience needed — every command is explained.
You need any Linux server with kernel 5.6 or newer — a $4/month VPS or a machine at home both work. First, install Docker:
curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker $USERLog out and back in so the group change takes effect, then verify with docker --version.
wg-easy protects its dashboard with a bcrypt-hashed password. Generate the hash with the built-in helper:
docker run --rm ghcr.io/wg-easy/wg-easy wgpw YourStrongPasswordImportant: when you paste the hash into docker-compose.yml, double every $ sign ($$), otherwise Compose treats it as a variable and login will fail.
Make a folder like ~/wg-easy and create the Compose file. You can download a ready-made template from our Download section. The two values you must edit are WG_HOST (your server's public IP or domain) and PASSWORD_HASH.
cd ~/wg-easy
docker compose up -d
docker compose logs -f wg-easyHealthy logs show WireGuard loading and the web server listening on port 51821.
Open http://YOUR_SERVER_IP:51821, log in, and click New Client. On your phone, install the official WireGuard app and scan the QR code. On desktop, download the .conf file and import it. Toggle the tunnel on — if the handshake counter updates in the dashboard, you're live.
ufw allow 51821/tcp).net.ipv4.ip_forward=1 is present in the compose file.$$ signs in your hash.For deeper fixes, see our guide on fixing common wg-easy connection problems. Once everything works, harden your setup with HTTPS and a reverse proxy.
Both approaches give you the same fast, modern WireGuard tunnel underneath. The difference is entirely about management — how you create clients, rotate keys, and maintain the server over time.
Manual WireGuard means installing packages, generating key pairs for the server and every client, writing wg0.conf by hand, and configuring NAT rules with iptables. Budget 30–60 minutes the first time. wg-easy wraps all of that into one container: realistically 5–10 minutes including Docker installation.
This is where the gap is widest. Adding a phone manually means generating keys, editing the server config, restarting the interface, and building a QR code yourself. In wg-easy it's one click — the QR code appears instantly, and disabling a lost device is a toggle switch.
Manual configs win for advanced topologies: site-to-site links, custom routing tables, multiple interfaces, or policy routing. wg-easy focuses on the classic "road warrior" setup — many devices connecting to one server — and covers the common options (DNS, allowed IPs, MTU) through environment variables.
With wg-easy, updating is docker compose pull && docker compose up -d. Backups mean copying one volume folder — see our backup guide. Manual setups have fewer moving parts (no Docker layer) but every change touches config files by hand.
There's no lock-in either way: wg-easy generates standard WireGuard configs, so you can always export your clients and go manual later.
The wg-easy dashboard controls who can enter your network — treat it like a crown jewel. Out of the box it serves plain HTTP on port 51821, which is fine on a LAN but not something you want exposed to the internet. Here's how to fix that.
A reverse proxy (Caddy, Nginx, or Traefik) sits in front of wg-easy and terminates HTTPS, so your login password never crosses the network in plain text. It also lets you use a nice URL like vpn.yourdomain.com and hide the raw port entirely.
Caddy obtains and renews Let's Encrypt certificates automatically. Point an A-record (e.g. vpn.yourdomain.com) at your server, then use a Caddyfile like this:
vpn.yourdomain.com {{
reverse_proxy wg-easy:51821
}}Run Caddy in the same Docker network as wg-easy and HTTPS just works — certificate renewal included.
With Nginx, obtain a certificate using certbot, then proxy traffic to the container:
location / {{
proxy_pass http://127.0.0.1:51821;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
}}Once the proxy works, stop exposing 51821 directly. In docker-compose.yml, bind it to localhost only:
ports:
- "51820:51820/udp"
- "127.0.0.1:51821:51821/tcp"Best practice: the most secure option is not exposing the dashboard publicly at all — access it only while connected to the VPN itself, or restrict it to your home IP in the proxy.
New to wg-easy? Begin with the installation guide first.
A Raspberry Pi makes a superb always-on VPN server: it sips 3–5 watts, runs silently, and WireGuard is light enough that even older models handle typical home traffic comfortably.
curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker $USERThe official wg-easy image is multi-arch, so the same ghcr.io/wg-easy/wg-easy tag works on ARM without changes.
Reserve an address like 192.168.1.50 for the Pi in your router's DHCP settings so port forwarding never breaks.
Most home connections have a changing public IP. Create a free dynamic DNS hostname (e.g. through your router's built-in DDNS options) and use that hostname as WG_HOST instead of an IP.
Follow the standard Docker Compose installation — it's identical on the Pi. Then forward UDP 51820 on your router to the Pi's LAN IP. Our port forwarding guide covers this in detail.
Real-world WireGuard throughput: a Pi 4 typically pushes hundreds of Mbit/s — more than most home upload speeds, which is the real bottleneck when you're connecting in from outside. A Pi 5 has headroom to spare; a Pi 3 is fine for browsing and remote access.
Tip: for reliability, use a quality power supply and consider moving Docker's data to an SSD if you notice SD-card wear over time.
A tiny, silent box that lets you reach your NAS, cameras, and desktop from anywhere — see accessing your home network with wg-easy for the full use case.
wg-easy uses exactly two ports, and mixing them up is the single most common beginner mistake. Here's what each one does and how to handle it correctly.
This is WireGuard itself. Every client connects to this port, so it must be reachable from the internet. On a VPS, open it in the firewall. At home, forward it on your router to your server's LAN IP:
This is the admin panel. It should not be casually exposed to the internet. Keep it LAN-only, restrict it to your IP, or serve it through an HTTPS reverse proxy — our security guide shows both approaches.
sudo ufw allow 51820/udp # VPN tunnel - required
sudo ufw allow from 192.168.1.0/24 to any port 51821 proto tcp # dashboard - LAN onlyUDP is connectionless, so "port checkers" often can't verify it directly. The reliable test is functional: connect a phone using mobile data (not your home Wi-Fi) and watch the client's handshake time update in the dashboard. If the handshake appears, UDP 51820 is working.
WG_HOST? It must be your public IP or DDNS name, never a 192.168.x.x address.More fixes in common wg-easy connection problems.
Ninety percent of wg-easy problems fall into four buckets. Work through them in order — each section starts with the symptom and ends with the fix.
Symptom: client shows the tunnel as on, but "latest handshake" never appears.
WG_HOST is wrong. It must be the server's public IP or domain. Check what the client config says under Endpoint.Symptom: handshake updates, but web pages don't load through the VPN.
This is almost always missing IP forwarding or NAT. Confirm your compose file contains:
sysctls:
- net.ipv4.ip_forward=1
- net.ipv4.conf.all.src_valid_mark=1
cap_add:
- NET_ADMIN
- SYS_MODULEThen recreate the container: docker compose up -d --force-recreate.
Symptom: you can open 1.1.1.1 in a browser but not normal websites.
Set an explicit DNS server for clients with WG_DEFAULT_DNS=1.1.1.1 (or your own resolver), then delete and re-create the client so it picks up the new config — existing configs don't update automatically.
$ in the bcrypt hash must be doubled ($$) inside docker-compose.yml.docker run --rm ghcr.io/wg-easy/wg-easy wgpw NewPassword.docker compose logs --tail 100 wg-easyLook for permission errors (missing capabilities) or port-binding conflicts (something else using 51820/51821).
Nuclear option: config corrupted beyond repair? Restore from backup — you do have one, right? If not, read the backup & restore guide today.
Everything wg-easy knows — server keys, every client, their names and settings — lives in a single directory: the /etc/wireguard volume. Back that up and you can rebuild your whole VPN anywhere without touching a single client device.
If you used a named volume (as in our template), archive it like this:
docker run --rm -v wg-easy_etc_wireguard:/data -v $(pwd):/backup \
alpine tar czf /backup/wg-easy-backup-$(date +%F).tar.gz -C /data .Copy the resulting .tar.gz somewhere off the server — object storage, another machine, anywhere that survives the server dying.
Put the same command in a script and schedule it with cron:
crontab -e
# run every night at 03:00
0 3 * * * /home/user/backup-wg.shRotate old archives (keep the last 7–14) so backups don't slowly fill the disk.
docker-compose.yml.docker run --rm -v wg-easy_etc_wireguard:/data -v $(pwd):/backup \
alpine tar xzf /backup/wg-easy-backup-2026-05-27.tar.gz -C /data
docker compose up -dBecause the server keys are identical, every existing client reconnects automatically — the only change needed is updating DNS/WG_HOST if the server IP changed.
Security note: backups contain private keys. Encrypt archives before uploading them anywhere (gpg -c file.tar.gz) and store the passphrase separately.
A backup you've never restored is a hope, not a plan. Once a quarter, spin up a cheap test VPS, run the restore, confirm a client connects, then destroy it. Ten minutes of practice beats a bad day later.
This is the setup most people build first: a VPN into your own house. Once it works, your phone anywhere in the world behaves as if it's on your home Wi-Fi — NAS drives mount, camera feeds open, and your smart-home dashboard loads like you never left.
wg-easy runs on a machine at home (a Raspberry Pi is perfect). Your router forwards UDP 51820 to it. Your devices carry a WireGuard profile that connects home whenever you need it.
Follow the installation guide, using a DDNS hostname as WG_HOST since home IPs change. Forward the port as shown in the port guide.
The AllowedIPs setting in each client controls this:
0.0.0.0/0): all traffic goes through home — great on public Wi-Fi, and websites see your home IP.192.168.1.0/24, 10.8.0.0/24): only home-network traffic uses the VPN; everything else goes out normally. Battery-friendlier and faster for daily use.You can set the default with WG_ALLOWED_IPS, or edit per-device in the client's config file.
While connected, use your normal LAN addresses: 192.168.1.20 for the NAS, 192.168.1.30:8123 for Home Assistant, and so on. If names don't resolve, use IPs or set WG_DEFAULT_DNS to your router or Pi-hole so local hostnames work too.
That's the whole recipe — one small box at home, and your entire network in your pocket.
Your privacy matters to us. This Privacy Policy explains what information wg-easy.guide ("we", "our", "this site") collects when you visit, and how it is used.
This is a static informational website. We do not require accounts, and we do not ask for your name, email address, or any personal details to read our content or download our starter files.
We do not set tracking cookies ourselves. Third-party services referenced below may set their own cookies according to their policies.
Our guides link to external websites. We are not responsible for the privacy practices or content of those sites, and we encourage you to review their policies.
We do not store user databases. The limited technical logs kept by hosting infrastructure are protected by our hosting provider's security measures.
This site provides technical documentation intended for a general audience and does not knowingly collect information from children.
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the latest revision.
Questions about this policy? Reach us through the Contact page.
By accessing wg-easy.guide, you agree to these Terms & Conditions. If you do not agree, please do not use this website.
wg-easy.guide is an independent, community-made educational resource about self-hosting a WireGuard-based VPN. We are not affiliated with, endorsed by, or connected to the official wg-easy project or WireGuard®.
All content and files are provided "as is", without warranty of any kind, express or implied. Running VPN software involves changes to your server, firewall, and network. You are solely responsible for reviewing every command and configuration before applying it to your systems.
To the maximum extent permitted by law, wg-easy.guide shall not be liable for any damages — including data loss, downtime, security incidents, or service costs — arising from the use of information or files obtained from this website.
You agree to use the knowledge and tools described here only in compliance with the laws of your jurisdiction and the terms of your hosting or network provider.
WireGuard® is a registered trademark of Jason A. Donenfeld. All other trademarks belong to their respective owners and are used for identification purposes only.
We may revise these terms at any time. Continued use of the site after changes constitutes acceptance of the updated terms.
In short: this is an independent educational guide. Test everything on a non-critical system first, and always keep backups.
All articles, diagrams, and downloadable files on this site are published for educational and informational purposes. They describe general procedures that may need adjustment for your specific server, operating system, or network environment.
wg-easy.guide is a community resource. We are not the developers of the wg-easy software, and we are not affiliated with WireGuard® or its trademark holder, Jason A. Donenfeld.
Deploying VPN software modifies networking rules, opens ports, and grants remote access to your systems. Mistakes can expose services to the internet or lock you out of your own server. Proceed carefully, follow security best practices, and never expose an admin panel without protection.
Software changes quickly. While we work to keep guides current, versions, environment variables, and defaults may change after publication. Always cross-check with the official documentation of the software you install.
Links to third-party websites are provided for convenience. We do not control and are not responsible for their content, availability, or policies.
Have a question about a guide, spotted a mistake, or want to suggest a new tutorial topic? We'd love to hear from you.
Email: hello@wgeasy.com
We usually reply within 2–3 business days.
We are an independent guide site — for bugs in the wg-easy software itself, please report them to the official project so the developers can fix them at the source.