Setting Up WG-Easy on a VPS: A Comprehensive Guide
A step-by-step walkthrough for deploying and securely accessing your WG-Easy VPN server.
Key Highlights
- Simplified VPN Management: WG-Easy provides a user-friendly web interface for managing your WireGuard VPN, making it easier to configure and maintain your server.
- Secure Remote Access: By setting up WG-Easy on a VPS, you can securely access your home network or other resources from anywhere.
- Enhanced Security Measures: Properly securing the WG-Easy dashboard is crucial to prevent unauthorized access and maintain the integrity of your VPN.
Understanding WG-Easy and Its Benefits
WG-Easy is a Docker image that simplifies the setup and management of WireGuard VPN servers. WireGuard is a modern VPN protocol known for its speed, security, and ease of use compared to traditional VPN solutions. WG-Easy enhances WireGuard by providing a web-based admin UI, making it easier to manage clients, view statistics, and configure the VPN server.
By using WG-Easy, you can quickly deploy a personal VPN server on a Virtual Private Server (VPS). This allows you to securely access resources on your home network, protect your internet traffic on public Wi-Fi, or bypass geographical restrictions.
Step-by-Step Guide to Setting Up WG-Easy on a VPS
Here's a detailed guide on how to set up WG-Easy on your VPS:
1. Prerequisites
Before you begin, ensure you have the following:
- A VPS running a supported Linux distribution (e.g., Ubuntu, Debian).
- SSH access to your VPS.
- Docker and Docker Compose installed on your VPS.
If Docker and Docker Compose are not yet installed, you can install them using the following commands:
sudo apt update
sudo apt install docker.io docker-compose-plugin
sudo systemctl start docker
sudo systemctl enable docker
2. Installing WG-Easy
The easiest way to install WG-Easy is by using Docker Compose. Follow these steps:
a. Create a docker-compose.yml file
Create a new directory for your WG-Easy setup and navigate into it:
mkdir wg-easy
cd wg-easy
Create a docker-compose.yml file using a text editor like nano or vim:
nano docker-compose.yml
Paste the following content into the docker-compose.yml file:
version: "3.6"
services:
wg-easy:
image: ghcr.io/wg-easy/wg-easy
container_name: wg-easy
environment:
# Replace with your desired WireGuard address range
WG_EASY_ADDRESS: 10.8.0.0/24
# Replace with your desired WireGuard interface listen port
WG_PORT: 51820
# Replace with your desired password for the web UI
WG_EASY_PASSWORD: your_admin_password
ports:
- "51820:51820/udp"
- "51821:51821/tcp"
volumes:
- ./wg-data:/etc/wireguard
sysctl:
- net.ipv4.ip_forward=1
- net.ipv4.conf.all.src_valid_mark=1
cap_add:
- NET_ADMIN
restart: unless-stopped
Remember to replace your_admin_password with a strong, unique password.
b. Run Docker Compose
Start the WG-Easy container by running the following command in the same directory as your docker-compose.yml file:
sudo docker compose up -d
This command downloads the WG-Easy image and starts the container in detached mode.
3. Accessing the WG-Easy Web UI
Once the container is running, you can access the WG-Easy web UI by navigating to your VPS's IP address or domain name on port 51821. For example:
https://your_vps_ip:51821
Log in using the password you set in the WG_EASY_PASSWORD environment variable in the docker-compose.yml file.
Securing Your WG-Easy Dashboard
Exposing the WG-Easy dashboard directly to the internet can pose security risks. It's essential to implement security measures to protect your VPN server from unauthorized access.
1. Using a Reverse Proxy
A reverse proxy adds a layer of security and enables you to use a domain name and SSL/TLS encryption for your WG-Easy web interface. Here's how to set it up using Nginx Proxy Manager:
a. Install Nginx Proxy Manager
You can install Nginx Proxy Manager using Docker Compose. Create a new docker-compose.yml file for Nginx Proxy Manager:
version: '3.8'
services:
app:
image: 'jc21/nginx-proxy-manager:latest'
container_name: nginx-proxy-manager
ports:
# These ports are in format <host-port>:<container-port>
- '80:80' # Public HTTP port
- '443:443' # Public HTTPS port
- '81:81' # Admin Web UI port
environment:
# Provide the domain name you will be using
DOMAIN: 'your_domain.com'
# Set a custom username and password
DB_USER: ${DB_USER:-nginxproxymanager}
DB_PASSWORD: ${DB_PASSWORD:-strong_random_password}
# Uncomment this if you want to use a database other than sqlite
# DB_HOST: your_database_host
# DB_PORT: your_database_port
# DB_NAME: your_database_name
volumes:
- ./data:/data
- ./letsencrypt:/etc/letsencrypt
restart: unless-stopped
Replace your_domain.com with your actual domain name, and set a strong password for DB_PASSWORD.
Start Nginx Proxy Manager:
sudo docker compose up -d
b. Configure Nginx Proxy Manager
- Access the Nginx Proxy Manager web UI by navigating to
http://your_vps_ip:81. - Log in using the default credentials:
- Email:
admin@example.com - Password:
changeme
- Email:
- Change the default credentials immediately after logging in.
- Create a new proxy host:
-
Domain Name:
wg-easy.your_domain.com(or any subdomain you prefer) -
Scheme:
https -
Forward Hostname / IP:
your_vps_iporlocalhost -
Forward Port:
51821 -
Enable "Cache Assets", "Block Common Exploits", and "Websockets Support".
-
Go to the SSL tab and request a new SSL certificate using Let's Encrypt.
-
2. Firewall Configuration
Ensure your firewall is configured to allow traffic only on the necessary ports. If you're using ufw, you can use the following commands:
sudo ufw allow 22/tcp # SSH
sudo ufw allow 80/tcp # HTTP (if needed)
sudo ufw allow 443/tcp # HTTPS
sudo ufw allow 51820/udp # WireGuard
sudo ufw enable
If you're using a reverse proxy, you can restrict access to port 51821, as it should only be accessed through the proxy.
3. Limiting Access to Specific IPs
If you only need to access the WG-Easy dashboard from specific IP addresses, you can configure your firewall to only allow traffic from those IPs.
Example Table: Comparing VPN Solutions
Here is an example comparison table that outlines the features and considerations of different VPN solutions, including WireGuard and WG-Easy.
| Feature | WireGuard | WG-Easy | OpenVPN |
|---|---|---|---|
| Ease of Setup | Moderate (requires manual configuration) | Easy (web-based UI) | Moderate (can be complex) |
| Performance | Very Fast | Very Fast | Good |
| Security | Excellent | Excellent | Good |
| Management | Command-line | Web UI | Command-line/GUI |
| Use Case | Advanced users, developers | Beginners, small teams | Versatile, widely supported |
Visual Aid: WG-Easy Dashboard
Below is a picture of the WG-Easy dashboard, showing its intuitive and user-friendly interface.
WG-Easy Dashboard Interface
This dashboard simplifies the management of WireGuard VPN connections, allowing users to easily create, edit, and delete clients.
Video Tutorial: Setting Up WG-Easy with Docker
This video provides a walkthrough on setting up WG-Easy using Docker. It covers the basics of installation and configuration, making it easier for users to follow along visually.
Easy WireGuard VPN Setup with Docker and WG-Easy
FAQ
What is WG-Easy?
WG-Easy is a Docker image that provides a web-based interface for managing WireGuard VPN servers, simplifying the setup and configuration process.
Why should I use WG-Easy?
WG-Easy offers an easy-to-use web interface, making WireGuard accessible to users who may not be comfortable with command-line configurations. It simplifies client management, provides statistics, and enhances overall VPN management.
How do I access the WG-Easy web interface?
After deploying WG-Easy, you can access the web interface by navigating to https://your_vps_ip:51821 in your web browser.
How do I secure my WG-Easy dashboard?
To secure your WG-Easy dashboard, use a reverse proxy like Nginx Proxy Manager, configure your firewall to allow traffic only on necessary ports, and limit access to specific IP addresses if possible.
What ports do I need to open on my firewall?
You need to open port 51820 (UDP) for WireGuard traffic and port 51821 (TCP) for the WG-Easy web interface. If you're using a reverse proxy, you only need to allow traffic on ports 80 (HTTP) and 443 (HTTPS).
Can I use a domain name with WG-Easy?
Yes, you can use a domain name with WG-Easy by setting up a reverse proxy and configuring your DNS records to point to your VPS's IP address.
References
markliversedge.blogspot.com
Last updated April 13, 2025