← All tutorials

Small Business Server

Give staff secure remote access with WireGuard VPN

Let your team reach office systems from anywhere, without exposing your server to the internet.

Intermediate12 min read5 steps

  1. KeysCreate key pairs
  2. ServerConfigure the VPN
  3. RouterForward one port
  4. ClientConnect the laptop

What you need

  • An Ubuntu server on your office network
  • Access to your router's port forwarding settings
  • A laptop with the WireGuard app

  1. Install WireGuard and create server keys

    Every device gets its own key pair. The private key must stay secret, and the public key is shared with the other side.

    sudo apt install -y wireguard
wg genkey | sudo tee /etc/wireguard/server.key | wg pubkey | sudo tee /etc/wireguard/server.pub
sudo chmod 600 /etc/wireguard/server.key

  2. Generate keys for the client

    The WireGuard desktop and mobile apps can generate a key pair themselves, which keeps the private key on the device. Add a tunnel in the app, then copy its public key for the next step.

  3. Configure the server

    Create /etc/wireguard/wg0.conf with this content, using the real keys. The VPN uses its own small network, which must not overlap your office network.

    [Interface]
Address = 10.10.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY

[Peer]
# Rahim's laptop
PublicKey = LAPTOP_PUBLIC_KEY
AllowedIPs = 10.10.0.2/32

  4. Start it and open the port

    Start the VPN, open its UDP port on the server, and forward UDP 51820 from your router to this server. To let VPN users reach other office devices as well, you would also need IP forwarding and a route or NAT rule.

    sudo systemctl enable --now wg-quick@wg0
sudo ufw allow 51820/udp
sudo wg show

  5. Configure the laptop and test

    Complete the tunnel in the app as follows, then activate it. Test by opening an office service while on a phone hotspot rather than the office Wi-Fi. If your office IP address changes, use a dynamic DNS name for the Endpoint.

    [Interface]
PrivateKey = (generated by the app)
Address = 10.10.0.2/32

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = YOUR_PUBLIC_IP:51820
AllowedIPs = 10.10.0.0/24, 192.168.10.0/24
PersistentKeepalive = 25

    Remove a person's [Peer] entry as soon as they leave or lose a device, then restart the service.

Want this set up for your business?

We can plan, build and hand it over to your team.

Discuss your setup ↗
Next tutorialPlan a reliable server for a small business →