What It Does

This is a Bash-based VPN server installer that automates the entire WireGuard deployment on Linux. Run it once and it handles kernel module checks, package installation, firewall configuration (iptables/nftables), and client profile generation. Plus, it spits out a QR code so you can import the config into the WireGuard mobile app without touching a text editor.

The script default install uses wg (WireGuard kernel module) for performance, but falls back to wireguard-go (userspace implementation) if the kernel module isn’t available. Dual-stack IPv4/IPv6 is enabled by default. Even so, you can tweak the generated config if your setup needs something custom. For multi-node setups, tools like Netbird build mesh VPN networks on top of WireGuard with automatic peer discovery.

Hands-On: Running the Install

We tested this on two fresh VPS instances (affiliate link) — an Ubuntu 24.04 node and a Debian 12 node — both with minimal base images. And both ran minimal images — no pre-installed tools, no old configs to trip over.

The install command:

wget -O wireguard.sh https://get.vpnsetup.net/wg && sudo bash wireguard.sh --auto

That’s it. No package manager dance, no modprobe checks, no manual firewall rules. The script detected WireGuard kernel support on both nodes automatically. Total time from SSH login to VPN-ready server: about 90 seconds on each machine.

The --auto flag runs non-interactively with sane defaults (default port 51820, first client named “client”). Without it, the script prompts for port selection and client name — useful if you’re juggling multiple WG instances on one machine.

What you get after install:

• A running wg0 interface with the server key pair
• Client config file at $HOME/client-wg0.conf
• A QR code displayed in terminal (scan-ready for iOS/Android WireGuard app)
• Firewall rules configured to forward traffic through the tunnel

Now, we did notice the script adds an iptables MASQUERADE rule automatically. If you’re running nftables-only, it handles the translation without issues — no conflicts observed.

The QR Code Feature Is Underrated

Most WireGuard setup guides end with “now copy this config file to your phone somehow.” But this script generates the QR code inline. Then we scanned it with the WireGuard iOS app, and the tunnel came up on the first attempt. That alone saves five minutes of SCP/email/file-transfer hassle. Sure, you could transfer the config manually — but why bother when the QR code is right there in your terminal?

Plus, the script includes user management commands — add or remove clients — which means you don’t need to touch wg-quick config files manually for basic operations.

What to Watch Out For

The script is opinionated. It expects a clean system without existing WireGuard installations. So if you’ve been tinkering with manual configs, the auto-detection might leave stale interfaces. We’d recommend running it on a fresh VM.

Also, it doesn’t configure DNS on the server side by default. The generated client config points to public DNS (1.1.1.1 or similar), which works fine for most use cases but isn’t ideal if you want all DNS queries routed through your tunnel for privacy. Our split tunneling guide covers DNS routing decisions in more detail. That’s a one-line edit in the client config, but worth knowing upfront.

The project has 2,100+ GitHub stars and sees regular updates — the developer has a solid track record with the IPsec counterpart (28,000+ stars over a decade of maintenance). Still, this is a single-maintainer project, not a corporate solution.

Bottom Line

If you need a self-hosted WireGuard VPN and don’t want to spend an afternoon debugging configs, hwdsl2/wireguard-install is the fastest path from zero to running tunnel. It works across major Linux distros, generates phone-ready QR codes, and has a proven maintainer behind it. Best fit for VPS owners, homelab operators, and anyone who wants a personal VPN without the subscription fees.