Overview

We built a remote-access VPN so your phone, PC, and any systems can reach any 192.168.1.x device at home from anywhere. The Raspberry Pi terminates WireGuard on wg0, then forwards traffic to your home LAN via wlan0 with NAT masquerading. Each client receives unique cryptographic keys and a dedicated VPN IP.

Pros & Cons

Network Topology Diagram

Phase 1: Install Raspberry Pi OS

Start by flashing Raspberry Pi OS to your microSD card using the official imaging tool.

1. Download Raspberry Pi Imager
   On your PC, install Raspberry Pi Imager from raspberrypi.com/software
2. Choose your configuration
   • Device: Raspberry Pi 5 (or your model)
   • OS: "Raspberry Pi OS (Lite 64-bit)" — desktop is optional
   • Storage: Your microSD card
3. Configure advanced settings (⚙️ gear icon)
   • Set username = pivpn
   • Set secure password (e.g., mypi123)
   • Enable SSH with password authentication
   • Configure Wi-Fi credentials or use Ethernet
4. Write, eject, and boot
   Write the image → Safely eject the card → Insert into Pi → Power it up
5. Connect via SSH
   From your PC on the same network:

   Copyssh pivpn@192.168.1.x

   Replace 192.168.1.x with your Pi's actual IP (check your router's DHCP list)
6. Update the system

   Copysudo apt update && sudo apt full-upgrade -y
   sudo reboot

Phase 2: Install WireGuard VPN (via PiVPN)

PiVPN is a convenient installer that automates WireGuard setup, profile generation, and firewall rules.

Run the installer

Copycurl -L https://install.pivpn.io | bash

Installation prompts

After installation completes:

Copysudo reboot

Phase 3: Create Your VPN Profiles

After the Pi reboots, create individual profiles for each device that will connect to your VPN.

Add a new client

Copypivpn add

Give it a simple name (e.g., phone or laptop). PiVPN generates the config file at:

Copy/home/pivpn/configs/phone.conf

Display QR code for mobile setup

Copypivpn -qr

Scan this QR code with the WireGuard mobile app (iOS/Android) to import the profile instantly.

Phase 4: Router Port Forwarding

Why? You must allow VPN traffic from the internet to reach your Pi. Without port forwarding, external clients cannot establish a connection.

1. Log into your home router (typically 192.168.1.1 or 192.168.0.1 in a browser)
2. Find the Port Forwarding, Virtual Server, or NAT section
3. Add a new forwarding rule with the following configuration:

After saving the rule:

CopyREBOOT THE ROUTER

Phase 5: Server Config (/etc/wireguard/wg0.conf)

This file is auto-generated by PiVPN when you add clients. Here's what a typical configuration looks like:

Copy[Interface]
PrivateKey = <SERVER_PRIVATE_KEY>
Address = 10.155.159.1/24
ListenPort = 51820
MTU = 1420

# Phone (10.155.159.2)
[Peer]
PublicKey = <MOBILE_PUBLIC_KEY>
PresharedKey = <PSK>
AllowedIPs = 10.155.159.2/32

# PC (10.155.159.3)
[Peer]
PublicKey = <PC_PUBLIC_KEY>
PresharedKey = <PSK>
AllowedIPs = 10.155.159.3/32

Auto-generated by pivpn add command

Phase 6: Client Configuration

Each client needs a profile that tells WireGuard how to connect and what traffic to route through the tunnel.

Copy[Interface]
PrivateKey = <MOBILE_PRIVATE_KEY>
Address = 10.155.159.2/24
DNS = 9.9.9.9, 149.112.112.112

[Peer]
PublicKey = <SERVER_PUBLIC_KEY>
PresharedKey = <PSK>
Endpoint = <YOUR_PUBLIC_IP>:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

Copy[Interface]
PrivateKey = <PC_PRIVATE_KEY>
Address = 10.155.159.3/24
DNS = 9.9.9.9, 149.112.112.112

[Peer]
PublicKey = <SERVER_PUBLIC_KEY>
PresharedKey = <PSK>
Endpoint = <YOUR_PUBLIC_IP>:51820
AllowedIPs = 0.0.0.0/0, ::/0, 192.168.1.0/24
PersistentKeepalive = 25

Phase 7: IP Forwarding & NAT Rules

These settings allow your Pi to act as a router, forwarding VPN traffic to your LAN and back.

Enable IP Forwarding

Copysudo nano /etc/sysctl.conf

Ensure these lines are present and uncommented (remove the # if present):

Copynet.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1

Save the file (Ctrl+O, Enter, Ctrl+X) and apply the changes:

Copysudo sysctl -p

Configure NAT & Traffic Forwarding

These iptables rules allow bidirectional traffic between wg0 (VPN interface) and wlan0 (Wi-Fi interface). If your Pi uses Ethernet, replace wlan0 with eth0.

Copysudo iptables -A FORWARD -i wg0 -j ACCEPT
sudo iptables -A FORWARD -o wg0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

Copysudo iptables -A FORWARD -i wg0 -j ACCEPT
sudo iptables -A FORWARD -o wg0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Verify your interface name:

Copyip a

Make Rules Persistent

Copysudo apt install iptables-persistent -y
sudo netfilter-persistent save

Restart WireGuard

Copysudo systemctl restart wg-quick@wg0

Phase 8: Verify & Test

Copysudo wg

Copyinterface: wg0
  peer: <PC_PUBLIC_KEY>
    endpoint: ***.***.***.***:xxxxx
    allowed ips: 10.155.159.3/32
    latest handshake: 12 seconds ago
    transfer: 2.51 KiB received, 1.83 KiB sent

Copyhostname -I

Copyping 10.155.159.1

Copyping 192.168.1.***

Copycurl ifconfig.me

AllowedIPs & Routing Modes Explained

WireGuard decides which traffic goes through the VPN using the AllowedIPs field in your client config. Understanding this setting is crucial for proper operation.

Full-Tunnel Mode (AllowedIPs = 0.0.0.0/0, ::/0)

All network traffic — internet and LAN — is sent through the VPN tunnel to your Raspberry Pi. This provides complete encryption and makes your device appear to browse from your home IP.

Split-Tunnel with LAN (AllowedIPs = 0.0.0.0/0, ::/0, 192.168.1.0/24)

This hybrid mode routes all traffic through the VPN (like full-tunnel) but explicitly includes the home LAN subnet. On Windows, adding 192.168.1.0/24 ensures proper routing table priority for LAN services.

LAN-Only Mode (AllowedIPs = 10.155.159.0/24, 192.168.1.0/24)

For users who only need access to home devices (not full internet through VPN), this mode keeps your regular internet connection local while tunneling only VPN and LAN traffic.

Troubleshooting Decision Tree

Common Issues & Solutions

Operations & Day-2 Tips

Copypivpn add                 # Add new client profile
pivpn -qr                 # Show QR code for mobile
pivpn list                # List all peers
pivpn remove              # Revoke a client
sudo wg                   # Show handshakes & traffic
sudo wg show wg0 transfer # Per-peer data transfer
sudo systemctl restart wg-quick@wg0
sudo netfilter-persistent save

Performance Monitoring

Copysudo wg show wg0 transfer      # Check data transfer per peer
sudo journalctl -u wg-quick@wg0 -f  # Live WireGuard logs
htop                                # Monitor CPU/RAM usage
vnstat -i wg0                       # Network statistics for wg0 interface

Glossary