Home Page » News » How To » How to Set Up a WireGuard VPN Server on Android (No Root) and Share It to Other Devices

How to Set Up a WireGuard VPN Server on Android (No Root) and Share It to Other Devices

14 min read Step‑by‑step guide to turn an Android phone into a WireGuard VPN server using Termux, without rooting, and share the connection to other devices. October 14, 2026 04:30

Many Android users rely on commercial VPN apps that only work on the phone itself. If you have a spare Android device with a decent data plan or a stable Wi‑Fi connection, you can turn it into a WireGuard server and let other phones, laptops, or IoT gadgets route their traffic through it. The whole process uses Termux, the official Linux terminal for Android, and does not require unlocking the bootloader or rooting the device.

Before you start

Android version: 7.0 (Nougat) or newer. Older versions lack the required kernel modules for WireGuard.
Termux app: Install the latest version from F-Droid or the official website. Google Play versions may be outdated.
Internet connection: The device will need an active network (Wi‑Fi or mobile data) that can reach the internet.
Battery: Keep the phone plugged in or ensure a full charge; running a VPN server can drain power quickly.
Permissions: Grant Termux storage permission (Settings > Apps > Termux > Permissions > Storage) so you can edit configuration files.

Note: This guide does not modify system files, so it works on stock Android. However, some manufacturers (e.g., Huawei) restrict background services; you may need to whitelist Termux in the battery‑optimization settings.

Step 1 – Install Termux and the WireGuard tools

Open Termux and run the following commands to update the package repository:
```
pkg update && pkg upgrade -y
```
Install the WireGuard utilities and a few helper packages:
```
pkg install wireguard-tools iproute2 iptables -y
```
Verify the installation:
```
wg --version
```
You should see something like wireguard-tools v1.0.20210914.

Step 2 – Generate a key pair for the server

Create a directory to hold the configuration and keys:
```
mkdir -p $HOME/wgserver && cd $HOME/wgserver
```

Generate a private key and derive the public key:

wg genkey | tee privatekey | wg pubkey > publickey

Store the keys safely. The private key stays on the phone; you will copy the public key to each client later.

Step 3 – Create the server configuration file

Open a text editor (nano is pre‑installed):
```
nano wg0.conf
```

Paste the following template, replacing <SERVER_PRIVATE_KEY> with the content of privatekey (you can view it with cat privatekey):

[Interface]
PrivateKey = <SERVER_PRIVATE_KEY>
Address = 10.0.0.1/24
ListenPort = 51820
# Optional: set a DNS server for clients
DNS = 1.1.1.1, 8.8.8.8

Save the file (Ctrl + O, Enter, Ctrl + X).

Step 4 – Enable IP forwarding on Android

WireGuard needs the kernel to forward packets between the VPN interface (wg0) and the physical network interface (usually wlan0). Android disables this by default.

Temporarily enable forwarding for the current session:
```
sysctl -w net.ipv4.ip_forward=1
```
To make it survive a reboot, add the command to Termux's ~/.bashrc file:
```
echo "sysctl -w net.ipv4.ip_forward=1" >> ~/.bashrc
```

Step 5 – Set up NAT (Network Address Translation)

Without NAT, devices that connect to the VPN would not be able to reach the internet because the Android kernel would try to forward packets with the VPN’s private address range (10.0.0.0/24) directly.

Identify the name of the network interface that provides internet access. Most phones use wlan0 for Wi‑Fi and rmnet0 for mobile data. Run:
```
ip link
```
Look for the interface that has an IP address in your local network.

Assuming it is wlan0, add a MASQUERADE rule:

iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

Allow forwarding from the VPN subnet to the internet:

iptables -A FORWARD -i wg0 -j ACCEPT
iptables -A FORWARD -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT

Persist the rules across reboots by appending the commands to ~/.bashrc (or create a small script that runs on boot via Termux:Widget).

Step 6 – Start the WireGuard server

Bring up the interface with the configuration you created:
```
wg-quick up $HOME/wgserver/wg0.conf
```
Check the status:
```
wg show
```
You should see the interface, its public key, and the listening port (51820).
To stop the server later, run wg-quick down $HOME/wgserver/wg0.conf.

Step 7 – Share the VPN over a Wi‑Fi hotspot

Android can broadcast a hotspot while still using its own internet connection (the “Wi‑Fi tethering” feature). Devices that join the hotspot will automatically receive the VPN’s address range if we route the traffic correctly.

Enable the hotspot: Settings > Network & Internet > Hotspot & tethering > Wi‑Fi hotspot. Choose a name and a strong password.
Make sure the hotspot interface (usually ap0 or wlan0 in hotspot mode) is added to the NAT rule. If the hotspot interface is ap0, update the iptables rule:
```
iptables -t nat -A POSTROUTING -o ap0 -j MASQUERADE
```
Optionally, limit the hotspot to a specific IP range that matches the VPN subnet (10.0.0.0/24) to avoid IP conflicts.

Step 8 – Create client configurations

Each device that will use the VPN needs its own key pair and a tiny config file that points to the Android server.

On the Android server, generate a client key pair (you can do this on the same device or on a PC):
```
wg genkey | tee client_privatekey | wg pubkey > client_publickey
```

Append a peer section to wg0.conf for this client (replace placeholders):

[Peer]
PublicKey = <CLIENT_PUBLIC_KEY>
AllowedIPs = 10.0.0.2/32

Save the file and reload the interface:

wg-quick down $HOME/wgserver/wg0.conf && wg-quick up $HOME/wgserver/wg0.conf

On the client device (Android, Windows, Linux, etc.), create a config file client.conf:
```
[Interface]
PrivateKey = <CLIENT_PRIVATE_KEY>
Address = 10.0.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = <SERVER_PUBLIC_KEY>
Endpoint = <SERVER_PUBLIC_IP_OR_DDNS>:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25
```
Endpoint note: If the Android phone is on the same local network as the client, use its local IP (e.g., 192.168.1.45). For remote access, set up a dynamic DNS service and forward UDP port 51820 on your home router to the phone.

Step 9 – Connect a client device

Android client: Install the official WireGuard app from the Play Store, import client.conf, and toggle the connection.
Windows/Linux/macOS: Install the WireGuard client, import the same config, and activate.

When the tunnel is up, visit https://www.whatismyip.com/ on the client. The displayed IP should be the public address of your Android phone (or of your home router if you used port forwarding).

Troubleshooting

1. Server does not start – “cannot bind socket”

Make sure no other app is using UDP 51820. Change the ListenPort in wg0.conf to an unused port and update the client config accordingly.
On some devices the kernel module for WireGuard is not loaded. Verify with modprobe wireguard; if the command fails, the device’s kernel does not support WireGuard without root.

2. Clients connect but have no internet

Check that IP forwarding is enabled (sysctl net.ipv4.ip_forward should return 1).
Confirm the NAT rule matches the correct outbound interface (use iptables -t nat -L -v to list rules).
Some manufacturers block tethering while a VPN is active. Disable any “VPN blocker” in the device’s battery‑optimization settings.

3. DNS leaks or resolution failures

Ensure the DNS line is present in the [Interface] section on the server and client. If the client still uses the local DNS, add DNS = 1.1.1.1 to the client config.
On Android clients, the WireGuard app may need the “Allow VPN on Wi‑Fi” permission (Settings > Apps > WireGuard > Permissions).

Safety and performance considerations

Data usage: All traffic from connected devices will flow through the Android phone’s network. Keep an eye on your mobile data plan if you are using cellular.
Battery impact: Encrypting and routing packets is CPU‑intensive. Expect higher battery consumption; keep the device plugged in for prolonged use.
Security: Treat the generated private keys like passwords. Do not share privatekey or client_privatekey publicly.
Port exposure: If you forward UDP 51820 from your home router, anyone who discovers your public IP could attempt to connect. Use strong, unique keys and consider changing the port to a non‑standard number.

What you have achieved

By following these steps you now have a fully functional WireGuard VPN server running on a standard Android device, without any rooting or custom ROMs. You can securely route traffic from laptops, other phones, or IoT gadgets through your phone’s connection, and you retain full control over encryption keys and network policies.

Because the setup lives entirely inside Termux, you can stop the server at any time with wg-quick down … and the Android system remains untouched. This makes the solution portable: move the wgserver folder to another Android device, run the same commands, and you are back online in minutes.

User Comments (0)

Add Comment

No comments added yet.

Add Comment

Your Name: *

Comment Title: *

Your E-mail: * We'll never share your email with anyone else.

Your Comment: *

Comments will not be approved to be posted if they are SPAM, abusive, off-topic, use profanity, contain a personal attack, or promote hate of any kind.