wg-easy: WireGuard VPN with a web admin interface

wg-easy (about 27,000 stars on GitHub) packages a WireGuard server together with a small web application. Instead of generating keys and editing wg0.conf by hand, you click “new client”, name it and scan a QR code with the WireGuard app. The page also shows which clients are connected and how much data they moved, and lets you disable a client without deleting it.

When to use it

• A personal or small-team VPN to reach a home lab or office network, or to route a phone’s traffic through a trusted server on public Wi-Fi.
• You want to hand out and revoke client configs without touching the server’s shell.
• Not a replacement for a mesh VPN such as Tailscale or Netbird when you have many devices behind different NATs: wg-easy is a classic hub where one server needs a reachable UDP port.

How to try it

The project ships a compose file; download it, start it and open the admin page:

sudo mkdir -p /etc/docker/containers/wg-easy
sudo curl -o /etc/docker/containers/wg-easy/docker-compose.yml https://raw.githubusercontent.com/wg-easy/wg-easy/master/docker-compose.yml
cd /etc/docker/containers/wg-easy
sudo docker compose up -d

Open UDP 51820 in your firewall for the VPN itself. The admin page on TCP 51821 wants TLS: either put a reverse proxy with a certificate in front (the docs include Caddy and Traefik examples) or set INSECURE=true in the compose environment and reach it only through an SSH tunnel. The tutorial in this topic walks through the whole setup, including the firewall and the first client.

Credit

wg-easy is developed by Emile Nijssen (WeeJeWel) and the wg-easy contributors and is released under the AGPL-3.0 license. WireGuard is a registered trademark of Jason A. Donenfeld.