HowTo: WireGuard VPN on Debian + Windows client

WireGuard = a modern, fast and simple VPN. We set up the server on Debian and the client on Windows, with commands and ready-to-copy config files.

1. Install + IP forwarding

sudo apt update && sudo apt -y install wireguard wireguard-tools
sudo sysctl -w net.ipv4.ip_forward=1
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-wg.conf

2. Generate keys (server + client)

cd /etc/wireguard
umask 077
wg genkey | sudo tee server_private.key | wg pubkey | sudo tee server_public.key
wg genkey | tee client_private.key | wg pubkey | tee client_public.key

3. Server config (wg0.conf)

sudo tee /etc/wireguard/wg0.conf >/dev/null <<'EOF'
[Interface]
Address = 10.10.0.1/24
ListenPort = 51820
PrivateKey = <CONTINUT_server_private.key>
PostUp   = nft add rule ip nat postrouting oif eth0 masquerade
PostDown = nft delete rule ip nat postrouting oif eth0 masquerade

[Peer]
# client Windows
PublicKey = <CONTINUT_client_public.key>
AllowedIPs = 10.10.0.2/32
EOF

4. Firewall + start

sudo ufw allow 51820/udp   # sau regula nftables echivalenta
sudo systemctl enable --now wg-quick@wg0
sudo wg show

5. Windows client config (client.conf)

# fisierul de config pt clientul Windows (client.conf)
[Interface]
PrivateKey = <CONTINUT_client_private.key>
Address = 10.10.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = <CONTINUT_server_public.key>
Endpoint = SERVER_PUBLIC_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

6. The Windows client

Download the official app from wireguard.com/install and install it.
Open WireGuard → Add Tunnel → Add empty tunnel (or import a .conf file).
Paste the client.conf content from step 5 (real keys, the server public IP in Endpoint).
Click Activate. The status turns active and you see the handshake.
Add the client public key as a [Peer] on the server (step 3) and systemctl restart wg-quick@wg0.

7. Verify

sudo wg show            # pe server: arata handshake-ul si transferul
ping 10.10.0.1          # de pe client, catre server
curl ifconfig.me        # de pe client: trebuie sa arate IP-ul serverului

Troubleshooting (no handshake)

If the tunnel does not come up, check in order: UDP port 51820 open on firewall/router, Endpoint = public IP + correct port, public/private keys not swapped, correct AllowedIPs and PersistentKeepalive = 25 if you are behind NAT.

sudo wg show                       # 'latest handshake' apare?
sudo ss -lunp | grep 51820         # serverul asculta pe UDP 51820?
sudo journalctl -u wg-quick@wg0 --no-pager | tail

Conclusion

You now have a working WireGuard tunnel between the server and Windows. We extend it with more clients, site-to-site or a kill-switch on request.