What is wg-easy? (And Why You'll Love It)

WireGuard is a modern, fast, and incredibly secure VPN protocol. Its only drawback? Managing it manually involves generating key pairs, editing configuration files, and a lot of command-line work. It's powerful, but not exactly user-friendly.

Enter wg-easy.

wg-easy is a lightweight, all-in-one Docker container that puts a simple, clean web interface on top of WireGuard. It completely automates the tedious parts:

• User Management: Add or remove VPN users (peers) with a single click.
• Configuration Generation: Automatically creates config files and QR codes for easy setup on mobile devices.
• Connection Stats: See who is connected, their data usage, and when they last connected.
• Simplicity: It bundles the WireGuard server and the management UI into one neat package.

Essentially, you get all the performance and security benefits of WireGuard without any of the configuration headaches. It’s the perfect solution for home labs, small businesses, or anyone who values their time.

Prerequisites: What You'll Need Before We Start

Before we jump in, make sure you have these three things ready. This guide assumes you're starting with a clean slate.

1. A Server: This can be a cloud VPS (from providers like DigitalOcean, Vultr, or Hetzner) or a machine at home, like a Raspberry Pi or an old laptop. It just needs to be running a modern Linux distribution (like Ubuntu 22.04 or Debian 12).
2. Docker and Docker Compose: Our entire setup runs in a container, which keeps things clean and isolated.
3. Basic Command-Line Access: You'll need to be comfortable connecting to your server via SSH and running a few simple commands.

The 5-Step Installation Guide

Alright, let's start the clock. This process is incredibly streamlined and should take you no more than 10 minutes.

Step 1: Get Docker and Docker Compose

If you don't have Docker installed, it's a straightforward process. The official Docker documentation is the best source, as the commands can vary slightly between Linux distributions. For most users, their convenience script is the fastest way.

curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh

This single command installs Docker Engine and the Docker Compose plugin. Once it's finished, you're ready for the next step. (Note: It's good practice to add your user to the `docker` group to avoid using `sudo` for every command, but that's a topic for another day!)

Step 2: Create Your Project Directory

Let's keep our project organized. Create a folder for your wg-easy configuration and navigate into it.

mkdir wg-easy
cd wg-easy

All our files will live inside this `wg-easy` directory, making it easy to manage, back up, or remove later.

Step 3: Craft the docker-compose.yml File

This is the heart of our setup. Create a file named `docker-compose.yml` using your favorite command-line editor, like `nano`.

nano docker-compose.yml

Now, copy and paste the following configuration into the file. I'll break down what each line means below.

version: "3.8"

services:
  wg-easy:
    image: weejewel/wg-easy
    container_name: wg-easy
    environment:
      # REQUIRED: The public IP or domain name of your server.
      - WG_HOST=YOUR_SERVER_IP

      # OPTIONAL: The password for the web UI.
      # If not set, the UI will be unprotected.
      - PASSWORD=YourSecurePassword

      # OPTIONAL: The port for the web UI.
      - WEBUI_PORT=51821

      # OPTIONAL: Comma-separated list of DNS servers for clients.
      # Defaults to 1.1.1.1, 1.0.0.1
      - WG_DEFAULT_DNS=1.1.1.1, 9.9.9.9

    volumes:
      # This persists your WireGuard configuration.
      - ./config:/etc/wireguard

    ports:
      # Port for the wg-easy Web UI.
      - "51821:51821/tcp"
      # Port for the WireGuard VPN traffic.
      - "51820:51820/udp"

    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1

Before you save, make these two critical changes:

• `WG_HOST`: Replace `YOUR_SERVER_IP` with your server's public IP address. This is the address your devices will connect to. If you're using a domain name, put that here instead.
• `PASSWORD`: Change `YourSecurePassword` to a strong, unique password to protect the admin panel. If you leave this blank, anyone who knows your server's IP can access the UI!

Save the file and exit the editor (in `nano`, that's `Ctrl+X`, then `Y`, then `Enter`).

Step 4: Launch wg-easy!

This is the magic moment. With your `docker-compose.yml` file in place, run the following command:

docker-compose up -d

Let's break that down: `docker-compose up` reads your file and starts the services defined in it. The `-d` flag stands for "detached mode," which means the container will run in the background, and you'll get your command prompt back.

Docker will now pull the `wg-easy` image and start the container. You can check its status with `docker-compose ps`.

Step 5: Access the Web UI & Create Your First Peer

Your VPN server is now running! Open a web browser and navigate to:

http://YOUR_SERVER_IP:51821

You'll be greeted by a login screen. Use the password you set in the `docker-compose.yml` file. Once logged in, you'll see a clean, empty dashboard.

To create your first VPN user (called a "peer" or "client"):

1. Click the "+ New Client" button.
2. Give it a descriptive name, like "MyLaptop" or "Sarahs-iPhone".
3. Click "Create".

That's it! wg-easy instantly generates the necessary keys and configuration. You now have two options to get the configuration onto your device: scan the QR code or download the `.conf` file.

Connecting Your Devices (The Payoff)

The final step is to install the official WireGuard client on your device (laptop, phone, etc.) and import the configuration.

• For Mobile (iOS/Android): Install the WireGuard app from the App Store or Google Play. Open the app, tap the `+` icon, and choose "Scan from QR code." Point your camera at the QR code in the wg-easy web UI. Done.
• For Desktop (Windows/macOS/Linux): Download the `.conf` file from the wg-easy UI. Install the official WireGuard client for your OS, and choose "Import tunnel(s) from file." Select the file you just downloaded. Done.

Toggle the connection on, and you're now securely routing your traffic through your own private VPN server! You can verify it's working by visiting a site like `icanhazip.com` before and after connecting—the IP address should change to your server's IP.

wg-easy vs. Manual WireGuard: A Quick Comparison

Still wondering why wg-easy is such a game-changer? This table breaks it down.

Final Thoughts: Your Secure VPN Awaits

And there you have it. In just a few minutes, you've deployed a fast, modern, and secure VPN with an interface that makes management a breeze. wg-easy abstracts away all the complexity of WireGuard, leaving you with a powerful tool that just works.

You now have a secure tunnel to the internet, perfect for protecting your data on public Wi-Fi, accessing your home network remotely, or simply enhancing your online privacy. Congratulations on taking control of your digital life!