Set up your own WireGuard VPN on a Vietnam VPS: a full walkthrough

If your team works across China and Vietnam, whether that means developers in Shenzhen coordinating with partners in Hanoi, or a logistics company running a shared ERP system between Guangzhou and Ho Chi Minh City, you need a VPN that is fast, auditable, and under your own control. A self-hosted WireGuard VPN on a Windows VPS (or a Linux VPS as an alternative) gives you exactly that: your own server in Vietnam, your own cryptographic keys, and no third party logging your traffic.

在越南服务器上自建WireGuard VPN，让你的跨境团队拥有安全、可控的专属网络通道。

Set up your own WireGuard VPN on a Vietnam server to give your cross-border team a secure, fully controlled network channel.

Prerequisites

• A Vietnam VPS running Ubuntu 24.04 LTS. A Windows VPS with a dedicated Vietnam IPv4 is ideal for teams that also need a persistent desktop environment via RDP. If you prefer Linux, any NVMe-based Linux VPS will work with the commands below.
• Root access (sudo) to the server.
• A domain name (optional, for convenience when the server IP changes).
• Basic familiarity with SSH and the command line.

Why run your own WireGuard VPN on a Vietnam VPS?

A commercial VPN shares its exit IP with thousands of users, many of those IPs are blacklisted, rate-limited, or blocked outright by services your team needs. With a self-hosted WireGuard server on a Vietnam VPS, you control who connects and which IP your traffic comes from. That matters for legitimate business uses: accessing a Vietnam-based bank portal from a Guangxi office, managing Vietnamese social media accounts for your brand, or connecting to a client VPN that only allows Vietnam IPs.

A Vietnam VPS for China business also solves latency and routing issues. Instead of bouncing through Hong Kong or Singapore, your traffic stays on domestic routes within Vietnam once it reaches your VPS, then crosses the China-Vietnam border via direct links between major cities like Nanning and Hanoi. Every thueVPS server sits in a Tier 3 datacenter operated by Viettel IDC or VNPT IDC, two of Vietnam largest providers, with direct peering to China telecoms at the border.

Step 1: Install WireGuard on Ubuntu 24.04

WireGuard is in the Ubuntu repository. Install it with a single command:

sudo apt update
sudo apt install wireguard -y

This installs both the kernel module (wireguard.ko) and the userspace tools (wg, wg-quick). No reboot needed.

Verify that the kernel module loads:

sudo modprobe wireguard
lsmod | grep wireguard

You should see output like wireguard ... 0. The zero just means no tunnels are active yet.

Step 2: Generate server and client keys

WireGuard uses Curve25519 key pairs. Generate the server private and public key:

cd /etc/wireguard
umask 077
wg genkey | tee server.key | wg pubkey > server.pub

The umask 077 is critical, it ensures the private key file is readable only by root. Generate one client key pair:

wg genkey | tee client1.key | wg pubkey > client1.pub

Repeat this for each team member. Keep the .key files secret; the .pub files go into the server config.

Step 3: Configure the WireGuard server interface (wg0.conf)

Create /etc/wireguard/wg0.conf with your preferred editor:

sudo nano /etc/wireguard/wg0.conf

Paste the following, replacing the private key with your server server.key content:

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = [paste server.key content here]

# Save this file as root only
[Peer]
# Client 1, replace PublicKey with client1.pub content
PublicKey = [paste client1.pub content here]
AllowedIPs = 10.0.0.2/32

For each additional client, add another [Peer] block with a unique /32 IP (10.0.0.3, 10.0.0.4, etc.) and that client public key.

Set the correct permissions on the config file:

sudo chmod 600 /etc/wireguard/wg0.conf

Step 4: Enable IP forwarding and configure nftables NAT

For your VPN clients to reach the internet through the Vietnam VPS IP, you need IP forwarding and a NAT rule.

Enable forwarding:

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Now configure nftables. Create /etc/nftables.conf:

sudo nano /etc/nftables.conf

Add these rules:

#!/usr/sbin/nft -f

flush ruleset

table inet nat {
    chain postrouting {
        type nat hook postrouting priority srcnat; policy accept;
        oifname "eth0" masquerade
    }
}

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        ct state established,related accept
        ct state invalid drop
        iifname "lo" accept
        udp dport 51820 accept
    }
    chain forward {
        type filter hook forward priority 0; policy drop;
        ct state established,related accept
        iifname "wg0" oifname "eth0" accept
    }
}

Replace eth0 with your server main interface name (check with ip link). Apply the rules:

sudo nft -f /etc/nftables.conf

Enable nftables on boot:

sudo systemctl enable nftables
sudo systemctl restart nftables

Step 5: Start and enable WireGuard as a systemd service

sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

Verify that the interface is up:

sudo wg show
ip addr show wg0

You should see the wg0 interface with IP 10.0.0.1 and a listening port on 51820.

Step 6: Configure the client (Windows, macOS, Linux, mobile)

Each client needs its own config file. On your local machine, create a file vietnam-vpn.conf:

[Interface]
PrivateKey = [paste client1.key content here]
Address = 10.0.0.2/24
DNS = 8.8.8.8

[Peer]
PublicKey = [paste server.pub content here]
Endpoint = [your-vps-public-ip]:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

The AllowedIPs = 0.0.0.0/0 routes all traffic through the VPN. If you only want traffic to your Vietnam resources, restrict it (e.g., 10.0.0.0/24 for internal, or specific Vietnam IP ranges). The PersistentKeepalive = 25 keeps the NAT mapping alive every 25 seconds, important for cross-border connections where intermediate firewalls drop idle UDP.

To generate a QR code for mobile clients (iOS/Android) without sending the private key over any network, install qrencode on your server and pipe the config directly:

sudo apt install qrencode -y
sudo qrencode -t ansiutf8 < /etc/wireguard/client1.conf

Scan the QR code with the WireGuard mobile app. The private key never leaves your screen.

Step 7: MTU tuning for cross-border China-Vietnam links

The default WireGuard MTU is 1420 bytes. On routes that traverse multiple tunnel layers or have high fragmentation (common on China to Vietnam VPS links), lowering the MTU reduces packet loss.

Add the MTU parameter to the [Interface] section in both server and client configs:

[Interface]
MTU = 1280
...

A value of 1280 is safe, it avoids fragmentation on virtually any path. Test with ping -M do -s 1472 10.0.0.1 (Linux) or equivalent to find your specific path MTU. Start with 1280 and increase if the link is clean.

Step 8: Verify the tunnel end-to-end

From the client, check that the tunnel is established:

sudo wg show

You should see the latest handshake time, if it shows never, the client or server firewall is blocking UDP port 51820. Then test that your public IP is the Vietnam VPS IP:

curl ifconfig.me

The output must show your VPS public IPv4, not your local IP. Also run a traceroute to confirm the path:

traceroute 10.0.0.1

Troubleshooting common issues

Handshake never happens

Check the firewall on both sides. On the server, ensure ufw or nftables allows UDP on port 51820. On the client, verify that no local firewall or corporate VPN is blocking outgoing UDP. Use tcpdump -i eth0 udp port 51820 on the server to see if packets arrive.

Traffic goes through but no internet

This is almost always the NAT rule. Confirm that net.ipv4.ip_forward is set (sysctl net.ipv4.ip_forward should return 1) and that the masquerade rule in nftables matches the correct interface name. You can test with nft list ruleset to see the active rules.

Slow speeds from China

Lower the MTU to 1280 (as covered in Step 7). Also check whether your client is behind a CGNAT (Carrier-Grade NAT). If your client has no public IP and the provider uses CGNAT, you may need to set PersistentKeepalive to 15 instead of 25.

FAQ

Related articles

• Set up a VPN for China users on Ubuntu 24.04
• Install OpenVPN on a VPS at thueVPS: a step-by-step guide
• Hardening SSH on a new VPS: keys, ports, fail2ban and CrowdSec
• Set up nftables firewall on a VPS to replace iptables