WireGuard VPN

WireGuard VPN setup and configuration guide.

WireGuardVPNNetworkingSecurity

Why WireGuard?

  • Simple: ~4,000 lines of code vs 100,000+ for OpenVPN
  • Fast: Kernel-level implementation, minimal overhead
  • Modern crypto: ChaCha20, Curve25519, BLAKE2s
  • Roaming: Handles IP changes
  • Cross-platform: Linux, Windows, macOS, iOS, Android

Server Configuration

Install WireGuard

bash
# Ubuntu/Debian
sudo apt update && sudo apt install wireguard

# Enable IP forwarding
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Generate Keys

bash
# Generate server keys
wg genkey | tee server_private.key | wg pubkey > server_public.key

# Set secure permissions
chmod 600 server_private.key

Server Config

ini
# /etc/wireguard/wg0.conf
[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <server_private_key>

# NAT for clients
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# Client 1
PublicKey = <client1_public_key>
AllowedIPs = 10.0.0.2/32

Client Configuration

Generate Client Keys

bash
wg genkey | tee client_private.key | wg pubkey > client_public.key

Client Config

ini
[Interface]
Address = 10.0.0.2/24
PrivateKey = <client_private_key>
DNS = 1.1.1.1

[Peer]
PublicKey = <server_public_key>
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

AllowedIPs Options

  • 0.0.0.0/0 - Route all traffic through VPN (full tunnel)
  • 10.0.0.0/24, 192.168.1.0/24 - Only route specific networks (split tunnel)

Management Commands

bash
# Start/stop interface
sudo wg-quick up wg0
sudo wg-quick down wg0

# Enable on boot
sudo systemctl enable wg-quick@wg0

# Check status
sudo wg show

# Add peer on the fly
sudo wg set wg0 peer <public_key> allowed-ips 10.0.0.3/32

Best Practices

  • Rotate keys periodically: Generate new key pairs annually
  • Use PersistentKeepalive: Required for NAT traversal (25 seconds typical)
  • Restrict allowed IPs: Only permit necessary traffic
  • Firewall the server: Only allow UDP 51820 from needed sources
  • Use QR codes: For mobile client deployment

Tip

Tip: Use qrencode -t ansiutf8 < client.conf to generate QR codes for mobile clients.
Back