A home WireGuard VPN on a Raspberry Pi

Who it is for

This is for someone who wants to reach a home computer, a file share, or a printer while they are on a hotel or phone network, without leaving those services open to the whole internet. The Pi joins your LAN and speaks WireGuard. Your phone or laptop runs the WireGuard app and becomes a temporary member of the house. It is a bad fit if your internet connection has no public address and you cannot forward a UDP port. In that case a relay-style mesh is the usual next reading, not a harder port-forward.

Source tutorial: PiVPN + WireGuard Complete Setup - Build Your Own VPN Server!.

Steps

1. Write Raspberry Pi OS Lite (64-bit) with Raspberry Pi Imager (https://www.raspberrypi.com/software/). Set a user and a password, enable SSH, skip Wi-Fi. Boot on Ethernet and reserve the address on the router.

2. Update the system. Then install WireGuard the way the upstream install page tells Debian and Ubuntu users to install it. Raspberry Pi OS is a Debian system. The command on https://www.wireguard.com/install/ is:

   sudo apt install wireguard

3. For a beginner, use PiVPN's installer rather than writing a config by hand. The documented command at https://docs.pivpn.io/install/ is:

   curl -L https://install.pivpn.io | bash

   That page also shows a clone-the-repo method if you want to read the script first. When it asks, choose WireGuard. Accept a static address if it offers to set one. The installer prints the UDP port it chose. Write that number down.

4. On the router, forward only that UDP port to the Pi. Do not forward SSH. If you do not control the router, stop. The tunnel will not answer from outside.
5. Add a client the way the installer tells you (it adds a pivpn command). On the phone or laptop, install the WireGuard app linked from https://www.wireguard.com/install/ and import the config or the QR code. The key steps, if you ever build a config by hand, are the ones on https://www.wireguard.com/quickstart/: wg genkey, wg pubkey, then bring the interface up. Prefer the installer's profile until you have a reason not to.
6. Turn the phone's Wi-Fi off and confirm you can open a page that exists only on the home network, such as the Pi-hole admin URL or the file share, if you already built those. If that works, you are done.