This guide will show you how to set up a "Road Warrior" VPN server on a Raspberry Pi. This setup turns your Pi into a secure gateway, allowing you to connect to your home Wi-Fi network from anywhere. You'll be able to access your files, manage smart home devices, and use your home internet connection as if you were sitting on your couch.

Prerequisites

Before you begin, you will need:

Setup & Configuration Steps

Step 1: Prepare Your Raspberry Pi

First, you need a fresh installation of Raspberry Pi OS Lite (64-bit). This version doesn't have a desktop, which is perfect for a server. Use the Raspberry Pi Imager to flash the OS to your SD card. In the imager's advanced settings, you can pre-configure your username/password and enable SSH for easy remote access.

Once the Pi is booted up, find its local IP address from your router's admin page and connect to it via SSH:

ssh your_username@RASPBERRY_PI_LOCAL_IP

Now, update your system:

sudo apt update
sudo apt full-upgrade -y

Step 2: Install WireGuard

Installing WireGuard on Raspberry Pi OS is straightforward:

sudo apt install wireguard -y

Step 3: Configure WireGuard for Home Access

This is where the setup differs from a cloud server. We will configure WireGuard to grant access to your home network.

First, generate the server keys:

sudo -i
cd /etc/wireguard/
wg genkey | tee privatekey | wg pubkey > publickey
chmod 600 privatekey
exit

Now, create the server configuration file:

sudo nano /etc/wireguard/wg0.conf

Paste in the following configuration. You must replace YOUR_SERVER_PRIVATE_KEY_HERE and check that eth0 is your Pi's network interface (ip a).

[Interface]
Address = 10.10.0.1/24
PrivateKey = YOUR_SERVER_PRIVATE_KEY_HERE
ListenPort = 51820

# This rule allows VPN clients to access your home network
# Replace 192.168.1.0/24 with your actual home network's subnet
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Finally, enable IP forwarding:

sudo sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/' /etc/sysctl.conf
sudo sysctl -p

Step 4: Port Forwarding on Your Home Router

Your home router's firewall blocks incoming connections by default. You need to create a port forwarding rule to send incoming WireGuard traffic to your Raspberry Pi.

  1. Log in to your home router's admin interface (usually an address like 192.168.1.1 or 192.168.0.1).
  2. Find the "Port Forwarding," "Virtual Server," or "Application Forwarding" section.
  3. Create a new rule with the following settings:
    • Service/Application Name: WireGuard (or anything you like)
    • External/WAN Port: 51820
    • Internal/LAN Port: 51820
    • Protocol: UDP (This is very important!)
    • Device/Internal IP: Your Raspberry Pi's local IP address.
  4. Save the rule.

Every router's interface is different. If you can't find this setting, search online for "port forwarding [your router model]".

Step 5: Handling Your Dynamic Home IP

Most home internet plans have a dynamic public IP address, meaning it can change. This will break your VPN connection. The solution is to use a Dynamic DNS (DDNS) service, which gives you a permanent hostname that always points to your home's current IP.

  1. Sign up for a free DDNS service like DuckDNS or No-IP.
  2. Create a hostname (e.g., my-home-vpn.duckdns.org).
  3. Follow their instructions to install a small client on your Raspberry Pi that will automatically update the DDNS service whenever your home IP changes.

Now, you will use your DDNS hostname (e.g., my-home-vpn.duckdns.org) in your client configuration instead of your home's IP address.

Step 6: Configure Your Client

Start the WireGuard service on your Pi:

sudo wg-quick up wg0
sudo systemctl enable wg-quick@wg0

Now, configure your client (e.g., your phone):

  1. Generate a key pair in your client app.

  2. Add the client as a peer on the Raspberry Pi:

    sudo wg set wg0 peer CLIENT_PUBLIC_KEY_HERE allowed-ips 10.10.0.2/32

  3. Create the client configuration file. Use your DDNS hostname in the Endpoint.

    [Interface]
PrivateKey = YOUR_CLIENT_PRIVATE_KEY_HERE
Address = 10.10.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = YOUR_SERVER_PUBLIC_KEY_HERE
Endpoint = my-home-vpn.duckdns.org:51820
AllowedIPs = 0.0.0.0/0, ::/0

  4. Import the config and connect! You should now be able to access the internet through your home connection and reach devices on your local network.

Conclusion

Your Raspberry Pi is now a powerful, always-on gateway to your home network. You have the convenience of accessing your local devices and the security of routing your traffic through your own trusted network, no matter where you are in the world.