Server Domain: velkhana.calmcacil.dev
Port: 51820
VPN IPv4 Range: 10.10.69.0/24
VPN IPv6 Range: fd69:dead:beef:69::/64
DNS: 8.8.8.8, 8.8.4.4 (Google)
Server-side peer configs: /etc/wireguard/conf.d/client-*.conf (loaded dynamically)
Client-side configs: /etc/wireguard/clients/*.conf (for distribution)

Installation

1. Upload script to VPS

scp wireguard.sh calmcacil@velkhana.calmcacil.dev:~/

2. Run installation

chmod +x ~/wireguard.sh
sudo ~/wireguard.sh install

Usage

Dynamic client loading

WireGuard automatically loads clients from /etc/wireguard/conf.d/:

Add/remove client configs in /etc/wireguard/conf.d/client-*.conf
Run sudo ~/wireguard.sh load-clients to reload
Changes are applied immediately without restarting

Add a new client

sudo ~/wireguard.sh add myphone

This creates:

Server config in /etc/wireguard/conf.d/client-myphone.conf
Client config in /etc/wireguard/clients/myphone.conf
QR code in /etc/wireguard/clients/myphone.qr

List all clients

sudo ~/wireguard.sh list

Show client config

sudo ~/wireguard.sh show myphone

Show QR code

sudo ~/wireguard.sh qr myphone

Remove a client

sudo ~/wireguard.sh remove myphone

Server Management

Check WireGuard status

sudo wg show

Check service status

sudo systemctl status wg-quick@wg0

Restart WireGuard

sudo systemctl restart wg-quick@wg0

Reload clients (automatic on add/remove)

sudo ~/wireguard.sh load-clients

Firewall management

The setup configures nftables with:

Dual-stack IPv4/IPv6 support in a single ruleset
Default drop incoming, accept outgoing
SSH access allowed (port 22)
WireGuard allowed (UDP 51820)
Forwarding from wg0 interface allowed
NAT masquerade for VPN internet access

View firewall rules:

sudo nft list ruleset

Reload firewall:

sudo nft -f /etc/nftables.conf

Note: nftables rules are automatically loaded on boot by the nftables service from /etc/nftables.conf. No manual intervention required after reboot.

Allow additional ports if needed:

sudo nft add rule inet wireguard input tcp dport 80 accept    # HTTP
sudo nft add rule inet wireguard input tcp dport 443 accept   # HTTPS

Manual Client Configuration

To manually add a client, create a file in /etc/wireguard/conf.d/:

[Peer]
# mydevice
PublicKey = <client_public_key>
AllowedIPs = 10.10.69.2/32, fd69:dead:beef:69::2/128

Then run:

sudo ~/wireguard.sh load-clients

Client Setup

Importing the config

Desktop: Import /etc/wireguard/clients/<name>.conf into WireGuard app
Mobile: Scan QR code with WireGuard app, or import config file

Test connectivity

# On client
ping 10.10.69.1
ping -6 fd69:dead:beef:69::1

# Check your IP
curl -4 https://ifconfig.me
curl -6 https://ifconfig.me

Troubleshooting

Check firewall

sudo nft list ruleset

Check IP forwarding

sysctl net.ipv4.ip_forward
sysctl net.ipv6.conf.all.forwarding

View logs

sudo journalctl -u wg-quick@wg0 -f

Check client directory

ls -la /etc/wireguard/conf.d/

Manual reload if needed

sudo ~/wireguard.sh load-clients

Notes

/etc/wireguard/conf.d/ - Server-side peer configs, loaded automatically by wireguard.sh
/etc/wireguard/clients/ - Client-side configs (import to WireGuard apps) and QR codes
Clients are automatically reloaded when added/removed
IPv4 and IPv6 NAT are configured (MASQUERADE)
nftables firewall is configured with dual-stack IPv4/IPv6 support
Single nftables ruleset handles both IPv4 and IPv6
SSH (port 22) and WireGuard (UDP 51820) are allowed by default
Keepalive is set to 25 seconds for better stability
Server private keys are stored in /etc/wireguard/server_private.key
Server public key is displayed after installation