WireGuard is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec and OpenVPN.
Key Generation
WireGuard requires a private and public key pair for every peer (server and clients).
# Generate a private key
wg genkey > privatekey
# Generate the corresponding public key from the private key
wg pubkey < privatekey > publickey
# Generate both in a single line (Useful for quick client creation)
wg genkey | tee privatekey | wg pubkey > publickeyBasic Configuration (/etc/wireguard/wg0.conf)
A standard server configuration file:
[Interface]
Address = 10.0.0.1/24
SaveConfig = true
ListenPort = 51820
PrivateKey = <Server-Private-Key>
# Enable IP forwarding (NAT) when the interface comes up
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
[Peer]
# Client 1
PublicKey = <Client1-Public-Key>
AllowedIPs = 10.0.0.2/32Service Management
WireGuard interfaces can be managed using the wg-quick tool, which wraps wg and handles routing/IP assignment.
# Start the interface
sudo wg-quick up wg0
# Stop the interface
sudo wg-quick down wg0
# Enable the interface to start on boot (via systemd)
sudo systemctl enable --now wg-quick@wg0Status & Monitoring
# Show status of all active WireGuard interfaces
sudo wg
# Show status of a specific interface
sudo wg show wg0