WireGuard is a fast and simple VPN protocol. It puts almost no load on the server and reconnects quickly when your phone switches networks.

So that you do not have to configure WireGuard by hand, we will install the wg-easy web panel for it. In the panel you create clients in a couple of clicks, and the connection settings come as a file or a QR code. We tested every step on an F3 Cloud server with Debian 12 and wg-easy version 15.4.

---

Step 1. Install Docker

wg-easy runs in Docker. Connect to the server via SSH as the root user and install Docker with the official script.

curl -fsSL https://get.docker.com -o get-docker.sh
sh get-docker.sh

If Docker is already installed on the server, you can skip this step. You can check this with the docker --version command.

---

Step 2. Start wg-easy

Create a folder for the panel, download the official settings file and start wg-easy.

# Folder for the panel files
mkdir -p /opt/wg-easy && cd /opt/wg-easy

# Official settings file from the wg-easy developers
curl -fsSL -o docker-compose.yml https://raw.githubusercontent.com/wg-easy/wg-easy/master/docker-compose.yml

# Allow opening the panel over plain http://
sed -i -e 's/^    #environment:/    environment:/' -e 's/^    #  - INSECURE=false/      - INSECURE=true/' docker-compose.yml

# Start the panel
docker compose up -d

Without the INSECURE=true setting, the new version of wg-easy only opens over HTTPS, and that needs a domain and a certificate. The sed command turns this setting on, so the panel is available straight away at the server's IP address.

The panel opens over HTTP without encryption

The panel password travels over the network in plain text when you log in. Choose a strong password for the panel and do not open it over public Wi-Fi.

If a firewall is enabled on the server, open port 51820/UDP for the VPN and port 51821/TCP for the panel in it. We showed how to do this in the article about the firewall.

---

Step 3. Set up the panel in the browser

Open http://SERVER-IP:51821 in your browser. On your first visit, a setup wizard opens in your browser's language.

1. Click Continue.
2. Choose an administrator username and password and click Create Account. You will use these details to log in to the panel.

Creating the panel administrator

3. When asked “Do you have an existing setup?”, answer No.
4. In the Host field, enter the server's IP address. The easiest way is to pick it with the Suggest button, and you need the line marked IPv4 - Public. Leave the port at 51820 and click Continue.

Server address and port for connections

5. The message “Setup successful” appears. Click Sign In and log in with the account you have just created.

---

Step 4. Create a client

A client is a separate profile for one device or one person. It is better to create different clients for a phone and a laptop, because then you can switch off any of them without touching the others.

Click New, enter a name, for example laptop, and click Create Client. You can leave the Expire Date field empty, and then the client will work with no time limit.

Creating a client

The client appears in the list. To the right of it are the buttons for managing it.

The client has been created

Button	What it does
Switch	Turns the client on and off
Pencil	Opens the client settings. You can also delete the client there with the Delete button
QR code	Shows a QR code for connecting from a phone
Down arrow	Downloads the .conf settings file for a computer
Link	Creates a temporary link to the settings file, which works for 5 minutes

---

Step 5. Connect to the VPN

To connect, you need the official WireGuard app.

1. Download WireGuard for Windows or macOS from the download page and install it.
2. In the wg-easy panel, download the settings file with the down arrow button.
3. In the WireGuard app, click Import tunnel(s) from file and choose the downloaded file.

Importing the settings file

4. Click Activate. When the Status line shows Active, the VPN is working.

The connection is established

1. Install WireGuard from the App Store or Google Play.
2. In the wg-easy panel, click the QR code button next to the client you need.

QR code for the phone

3. In the WireGuard app, tap +, choose scanning a QR code and point the camera at the screen.
4. Turn on the switch next to the added tunnel.

VPN enabled on the phone

To check that your traffic goes through the VPN, open api.ipify.org in your browser. It should show your server's IP address.

The settings file and QR code are the key to your VPN

Anyone who gets hold of the settings file or the QR code can connect to your server. Do not publish them or send them through public chats.

---

Frequently asked questions

The panel does not open

Check that wg-easy is running with the docker ps command. The list should include the wg-easy container with the Up status. Make sure you open the address with http://, not https://, and that port 51821/TCP is open in the firewall.

The VPN does not connect

Most often, port 51820/UDP is closed in the server's firewall. Also check that the Host field in the setup wizard contains the server's public IP address. If it shows an internal address such as 10.42.42.42, correct it in Admin Panel → Config and download the settings file again.

I forgot the panel password

You can reset the administrator password with a command on the server. It will ask you to enter a new password.

cd /opt/wg-easy && docker compose exec -it wg-easy cli db:admin:reset

How to update wg-easy

Run two commands. Your clients and settings are kept during the update.

cd /opt/wg-easy && docker compose pull && docker compose up -d

WireGuard does not work on my network

Some providers and networks block WireGuard. In that case, use protocols that are harder to detect, for example Amnezia or VLESS Reality in 3X-UI.

---

Our resources

Telegram channel: https://t.me/f3cloud_news
F3 Cloud: https://f3cloud.com