HOW TO SET UP A WIREGUARD VPN SERVER WITH PIHOLE

Introduction §

• March 2025: this tutorial has been updated to be compatible with PiHole v6. Thanks everybody for pointing that out to me 🙃;
• July 2023: this guide is now compatible with Debian 12 ✨;

Installation §

marco@vpnnode:~$ sudo apt install wireguard

marco@vpnnode:~$ sudo nft -v
nftables v1.0.6 (Lester Gooch #5)

Configure Wireguard(Server) §

root@vpnnode:~# mkdir -p /etc/wireguard/
root@vpnnode:~# cd /etc/wireguard/

root@vpnnode:/etc/wireguard# wg genkey | tee privkey | wg pubkey > pubkey
root@vpnnode:/etc/wireguard# ls -lh
total 8.0K
-rw-r--r-- 1 root root 45 Aug  6 08:46 privkey
-rw-r--r-- 1 root root 45 Aug  6 08:46 pubkey
root@vpnnode:/etc/wireguard# cat privkey
+LoX/Rrh2VR6nFiExOweXR37HluHdOhjBiFu7jqK7mo=

1. PrivateKey is equal to privkey;
2. Address is the CIDR mask of the VPN(i.e. from 192.168.2.1 to 192.168.2.254);
3. ListenPort is the UDP port where the Wireguard server will listen to.

root@vpnnode:/etc/wireguard# cat wg0.conf
[Interface]
PrivateKey = +LoX/Rrh2VR6nFiExOweXR37HluHdOhjBiFu7jqK7mo=
Address = 192.168.2.1/24
ListenPort = 48965

Configure the firewall §

flush ruleset

table inet filter {
	chain input {
		type filter hook input priority filter;
	}
	chain forward {
		type filter hook forward priority filter;
	}
	chain output {
		type filter hook output priority filter;
	}
}

# Wireguard NAT
add table wireguard-nat

table ip wireguard-nat {
	chain prerouting {
		type nat hook prerouting priority -100; policy accept;
	}

	chain postrouting {
		type nat hook postrouting priority 100; policy accept;
		oifname "ens3" masquerade # Be sure to replace 'ens3' with your network interface
	}
}

chain input {
        type filter hook input priority filter; policy drop; # Drop all packets by default
        iifname "lo" accept comment "Accept loopback interface" # Accept traffic from loopback device

        # Accept established and related packets
        ct state established,related counter accept comment "Accept established and related packets"
        ct state invalid counter drop comment "Drop invalid packets"

        # Allow ICMP requests
        icmp type echo-request counter accept comment "Accept incoming ICMP"

        # Allow inbound HTTP and HTTPS traffic
        tcp dport { 80, 443 } counter accept comment "Accept incoming services"
        # Allow inbound UDP traffic for Wireguard
        udp dport { 48965 } counter accept comment "Accept Wireguard packets"
}

$> sudo systemctl restart nftables

Enable IP forwarding §

root@vpnnode:/etc/wireguard# sysctl -w net.ipv4.ip_forward=1
net.ipv4.ip_forward = 1

# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1

Configure Wireguard(Client) §

[Interface]
PrivateKey = ni16f/oyWn8G0rdsJ7YGyytjXvJSfaNzhzFSG5Bv4Gg= # <-- client private key
Address = 192.168.2.2/24
DNS = 192.168.2.1

[Peer]
PublicKey = 4wzgj/0u53Jiheq8DjwQ9GRnvnzv0qcsisKARdnrr1c= # <-- server public key
PresharedKey = PW21sz8kl+nY8WRNJEypkqWJGLARSX2A5KjbPfaEUp0= # <-- wg genpsk
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = <SERVER_IP_ADDRESS>:48965
PersistentKeepalive = 15

1. PrivateKey: replace it with client's private key(you can generate a new keypair using wg genkey | tee privkey | wg pubkey > pubkey command if you do not use a graphical client);
2. PublicKey: replace with server's public key(i.e. /etc/wireguard/pubkey file on the VPN server);
3. PresharedKey: you can generate a preshared key with wg genpsk(this field is optional);
4. Endpoint: the IP address of your server with the Wireguard UDP port.

Back to the server §

[Interface]
PrivateKey = +LoX/Rrh2VR6nFiExOweXR37HluHdOhjBiFu7jqK7mo=
Address = 192.168.2.1/24
ListenPort = 48965

# Add this
[Peer]
PublicKey = 1+54fGF/zZlVTxDiJ3rlmrH65+5K1NMFKwxlniA/2js= # <-- Client public key
PresharedKey = PW21sz8kl+nY8WRNJEypkqWJGLARSX2A5KjbPfaEUp0=
AllowedIPs = 192.168.2.2/32

1. PublicKey is the public key of the client;
2. PresharedKey is the preshared key previously generated on the client configuration;
3. AllowedIPs is the client's IP address.

root@vpnnode:/etc/wireguard# systemctl enable wg-quick@wg0 --now
root@vpnnode:/etc/wireguard# wg
interface: wg0
public key: 4wzgj/0u53Jiheq8DjwQ9GRnvnzv0qcsisKARdnrr1c=
private key: (hidden)
listening port: 48965

peer: 1+54fGF/zZlVTxDiJ3rlmrH65+5K1NMFKwxlniA/2js=
preshared key: (hidden)
allowed ips: 192.168.2.2/32

Configuring PiHole §

version: "3"

# More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/
services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    # For DHCP it is recommended to remove these ports and instead add: network_mode: "host"
    ports:
      - "192.168.2.1:53:53/tcp"
      - "192.168.2.1:53:53/udp"
      - "192.168.2.1:8888:80/tcp"
    dns:
      - 127.0.0.1
      - 1.1.1.1
    environment:
      TZ: 'Europe/Rome'
      FTLCONF_webserver_api_password: 'BADPW' # Set your password here
    # Volumes store your data between container upgrades
    volumes:
      - './etc-pihole:/etc/pihole'
      - './etc-dnsmasq.d:/etc/dnsmasq.d'
    restart: unless-stopped

marco@vpnnode:~$ docker-compose ps
 Name    Command       State                                                     Ports                                               
-------------------------------------------------------------------------------------------------------------------------------------
pihole   start.sh   Up (healthy)   123/udp, 443/tcp, 192.168.2.1:53->53/tcp, 192.168.2.1:53->53/udp, 67/udp, 192.168.2.1:8888->80/tcp

1. Open the "Settings" drop-down menu from the left pane;
2. Click on "All settings";
3. Scroll down to the dns.listeningMode and select the SINGLE option;
4. Click "Save & Apply" button on the bottom right corner.

Conclusions §

1.1.1.1/help §

blockads.fivefilters.org §

dnsleaktest.com §

openresolver.com §