The high level steps are as follows:

• Reserve an external IP address
• Configure a firewall to allow all traffic
• Create a VM
• Set up the WireGuard server
• Set up the WireGuard client(s)

Reserve an external IP address

Go to the IP address page in GCP, and click “Reserve static IP address”.

In order to receive the free 200GB/mo, select “Standard” network service tier.

The region you choose here will be what websites will think your location is based on the IP address.

Configure a firewall

Next, go to the firewall page and create a new “firewall rule”.

Use the following configuration:

• Direction: ingress
• Targets: All instances in the network
• IP Range: “0.0.0.0/0” (allow all traffic)
• Protocols and ports: click “Specified protocol and ports”, tick “UDP” and set the port to 51820

Create a VM

Go to the compute engine page, create a new instance.

Use the following config:

• For the machine, select N1, then choose f1-micro. This is the cheapest machine
• In “Boot disk”, change this to Ubuntu. Should be version 20.04 LTS
• In the networking, make sure to configure the following two things:

• Select the external IP address to be the one created earlier
• Tick “IP forwarding”

Set up WireGuard server

Next, SSH into the VM. Run the following commands:

1. Update the system

2. Check if a reboot is required:

If the response is “*** System restart required ***”, reboot the VM instance.

3. Turn on IP forwarding for IPv4

Edit the file /etc/sysctl.conf and uncomment this line:

Then apply changes by running

4. Install WireGuard

5. Create server keys

This will create a public and private server key. You can use this command to see the contents:

6. Check your default network interface

Keep note of this:

This is used in the next step as the “YOUR_NETWORK_INTERFACE” variable.

7. Create a config file for WireGuard server

Edit this file:

Fill it with the below content:

8. Set permissions for the server files to be accessible only by root

9. Turn on wg0 WireGuard interface:

Make sure wg0 already running, and it’s public key is equal to content of server.key.pub:

10. Set wg0 to be started at boot

11. Open WireGuard port through firewall

Open port for SSH as well

12. Turn on firewall

13. Check firewall status, make sure the port for WireGuard and SSH are opened.

14. Set MTU size to 1360 due to limitation in Google Cloud Platform.

Set up WireGuard clients

The steps here include:

• Create keys
• Create a config
• Create a QR code based on the config

1. Create keys

For each client, new keys need to be created, run these commands:

In this example, the client is called “mobile”.

2. Create a config / interface for the client

Create a new config file:

The contents of the file should be:

Variable definitions:

• CLIENT’S-PRIVATE-KEY will be from /etc/wireguard/clients/mobile.key
• PRIVATE-IP-OF-WIREGUARD-SERVER will be for example: 10.0.0.2/24, for each new client, just bump the last number, i.e. 10.0.0.3/24
• YOUR-SERVER'S-PUBLIC-KEY will be from /etc/wireguard/keys/server.key.pub
• STATIC-IP-OF-GCP-INSTANCE is the static IP address that was reserved at the start

To get key values you can run:

3. (optional) Use a DNS server that filters ads

To have ad filtering installed, you can change the value of DNS to be one of the options from AdGuard’s DNS servers. See below:

Default servers

AdGuard DNS will block ads and trackers.

Non-filtering servers

AdGuard DNS will not block ads, trackers, or any other DNS requests.

Family protection servers

AdGuard DNS will block ads, trackers, adult content, and enable Safe Search and Safe Mode, where possible.

4. Add the client to the server interface

Variable definitions:

• YOUR_CLIENT_PUBLIC_KEY will be from /etc/wireguard/clients/mobile.key.pub
• YOUR_CLIENT_VPN_IP will be what you defined in the previous step, i.e. 10.0.0.2 or 10.0.0.3

Once you’ve run this, you can verify that the client has been added to the server by running:

You can also run this command to see the data usage by client.

5. Create QR codes

First, make sure the library is installed:

Temporarily make the relevant files accessible:

Create the QR code:

Then change access back to root (IMPORTANT):

Once you have the QR code, open the WireGuard app on the phone, tablet, computer, etc, add a tunnel and just scan the QR code.

References

https://dhanangw.medium.com/setup-wireguard-vpn-in-google-cloud-platform-67ddb692b2d8

https://wireguard.how/server/google-cloud-platform/