WireGuard - Revision history

Sam: Added attribution

2025-10-16T23:01:15Z

Added attribution

← Older revision		Revision as of 23:01, 16 October 2025
Line 190:		Line 190:
	* Add another <code>[Peer]</code> section to the server configuration.		* Add another <code>[Peer]</code> section to the server configuration.
	* Reload the WireGuard server.		* Reload the WireGuard server.

			== See also ==

			Thank you to "Mark Liversedge" at [https://markliversedge.blogspot.com/2023/09/wireguard-setup-for-dummies.html Wireguard setup for dummeies] with his comprehensive guide that made this possible for me

Sam: /* Generate a public/private key pair */ Changed created to generated

2025-10-16T22:51:45Z

Generate a public/private key pair: Changed created to generated

← Older revision		Revision as of 22:51, 16 October 2025
Line 51:		Line 51:
	=== Generate a public/private key pair ===		=== Generate a public/private key pair ===

	* ~~Create~~ a private and public key for the server. You can use the following command:		* Generate a private and public key for the server. You can use the following command:
	wg genkey \| tee server-privatekey \| wg pubkey > server-publickey		wg genkey \| tee server-privatekey \| wg pubkey > server-publickey

	**<code>server-privatekey</code> and <code>server-publickey</code> are filenames and can be anything you want and can be changed accordingly. These files are not directly used by WireGuard.		**<code>server-privatekey</code> and <code>server-publickey</code> are filenames and can be anything you want and can be changed accordingly. These files are not directly used by WireGuard.

Sam: /* Generate a public/private key pair */ Changed created to generated

2025-10-16T22:50:21Z

Generate a public/private key pair: Changed created to generated

← Older revision		Revision as of 22:50, 16 October 2025
Line 116:		Line 116:
	=== Generate a public/private key pair ===		=== Generate a public/private key pair ===

	* We will ~~create~~ a public/private key pair much the same way as we did for the server:		* We will generated a public/private key pair much the same way as we did for the server:
	wg genkey \| tee client-privatekey \| wg pubkey > client-publickey		wg genkey \| tee client-privatekey \| wg pubkey > client-publickey
	** The name <code>client</code> for the file name can be changed to anything you like for convenience.		** The name <code>client</code> for the file name can be changed to anything you like for convenience.

Sam: /* Adding peers to the server configuration */ Corrected configuration file, added italics

2025-10-16T22:49:38Z

Adding peers to the server configuration: Corrected configuration file, added italics

← Older revision		Revision as of 22:49, 16 October 2025
Line 150:		Line 150:

	* Open the server configuration file - <code>nano wg0.conf</code>		* Open the server configuration file - <code>nano wg0.conf</code>
	* Add the <code>[Peer]</code> section as follows:		* Add the <code>[Peer]</code> section, marked in italics, as follows:
	[Interface]		[Interface]
	## Local Address : A private IP address for wg0 interface.		## Local Address : A private IP address for wg0 interface.
	Address = 10.20.10.1/24		Address = 10.20.10.1/24
Line 164:		Line 164:
	PostDown = iptables -D FORWARD -i wg0 -j ACCEPT		PostDown = iptables -D FORWARD -i wg0 -j ACCEPT
	PostDown = iptables -t nat -D POSTROUTING -o em1 -j MASQUERADE<br>		PostDown = iptables -t nat -D POSTROUTING -o em1 -j MASQUERADE<br>
	[Peer]		''[Peer]''
	~~[Peer]~~		''# one client which will be setup to use 10.20.10.2 IP''
	# one client which will be setup to use 10.20.10.2 IP		''PublicKey = 92p5r33HRrEvzlQJIdANcyIKx0JgtNV5VfQOOwLnFwM=''
	PublicKey = 92p5r33HRrEvzlQJIdANcyIKx0JgtNV5VfQOOwLnFwM=		''AllowedIPs = 10.20.10.2/32''
	AllowedIPs = 10.20.10.2/32
	* Tweak the file to match your client configuration:		* Tweak the file to match your client configuration:
	** <code>PublicKey = 92p5r33HRrEvzlQJIdANcyIKx0JgtNV5VfQOOwLnFwM=</code> - the public key generated for the client.		** <code>PublicKey = 92p5r33HRrEvzlQJIdANcyIKx0JgtNV5VfQOOwLnFwM=</code> - the public key generated for the client.

Sam: Completed article

2025-10-16T22:47:24Z

Completed article

@@ Line 136: / Line 136: @@
   AllowedIPs = 0.0.0.0/0
   Endpoint = example.com:33333
-* Tweak the file to match your server configuration:
+* Tweak the file to match your client configuration:
 ** <code>PrivateKey = 4JYkCM3VBuRpJAHjj8S8LyunF+Can5ZLCxB8OjXo9WI=</code> - the private key generated for the client ('''NOT''' the server private key).
 ** <code>ListenPort = 33333</code> - needs to match the <code>ListenPort</code> for the server.
@@ Line 149: / Line 149: @@
 === Adding peers to the server configuration ===
-* Open the server configuration file - <code>sudo nano wg0.conf</code>
+* Open the server configuration file - <code>nano wg0.conf</code>

Sam: Added more to article, saving progress

2025-10-16T22:32:47Z

Added more to article, saving progress

@@ Line 49: / Line 49: @@
 You will find this directory is empty - we will work in this directory which is secure.
-=== Generate public/private key pair ===
+=== Generate a public/private key pair ===
 * Create a private and public key for the server. You can use the following command:
@@ Line 107: / Line 107: @@
 * The public key should match the one generated earlier and can be viewed by typing <code>cat server-publickey</code>
 * If you would like WireGuard to start on startup, type the following: <code>systemctl enable wg-quick@wg0</code>

Sam: /* Configure the server */ Split the section up and added permissions bullet point

2025-10-16T00:10:41Z

Configure the server: Split the section up and added permissions bullet point

← Older revision		Revision as of 00:10, 16 October 2025
Line 37:		Line 37:
	We will now configure the server settings for WireGuard. WireGuard comes complete with tools to create the the private/public keys needed to function and is configured with a simple configuration file.		We will now configure the server settings for WireGuard. WireGuard comes complete with tools to create the the private/public keys needed to function and is configured with a simple configuration file.

			=== Become a superuser ===
	For the following sets, you may need to become a superuser (<code>su</code>) to access the WireGuard folder.		For the following sets, you may need to become a superuser (<code>su</code>) to access the WireGuard folder.

	* Become a superuser - <code>su</code>		* Become a superuser - <code>su</code>

			=== Move to WireGuard directory ===

	* Type your root password and press {{key press\|Enter}}. The terminal text should change to red to indicate you are now a superuser.		* Type your root password and press {{key press\|Enter}}. The terminal text should change to red to indicate you are now a superuser.
	* Move to the WireGuard directory - <code>cd /etc/wireguard</code>		* Move to the WireGuard directory - <code>cd /etc/wireguard</code>

	You will find this directory is empty - we will work in this directory which is secure.		You will find this directory is empty - we will work in this directory which is secure.

			=== Generate public/private key pair ===

	* Create a private and public key for the server. You can use the following command:		* Create a private and public key for the server. You can use the following command:
Line 64:		Line 70:
	* Change the permissions of the private key so that only superusers can access the key: <code>chmod 600 server-privatekey</code>		* Change the permissions of the private key so that only superusers can access the key: <code>chmod 600 server-privatekey</code>
	* We need the private key to put in the configuration file: <code>cat server-privatekey</code>. This will display the key on the screen which can then be copied.		* We need the private key to put in the configuration file: <code>cat server-privatekey</code>. This will display the key on the screen which can then be copied.

			=== Create configuration file ===

	* We will create a configuration file with the same name as the interface WireGuard will create: <code>nano wg0.conf</code>		* We will create a configuration file with the same name as the interface WireGuard will create: <code>nano wg0.conf</code>
	* Insert the following into the file:		* Insert the following into the file:
Line 85:		Line 94:
	** <code>PostUp = iptables -t nat -A POSTROUTING -o em1 -j MASQUERADE</code> and <code>PostDown = iptables -t nat -D POSTROUTING -o em1 -j MASQUERADE</code> - the interface needs changing according to the name of the Ethernet card on your computer (<code>em1</code> in this example</code>, which can be found by typing <code>ip a</code>. Common names include <code>eth0</code>, <code>eno1</code> and <code>em1</code>.		** <code>PostUp = iptables -t nat -A POSTROUTING -o em1 -j MASQUERADE</code> and <code>PostDown = iptables -t nat -D POSTROUTING -o em1 -j MASQUERADE</code> - the interface needs changing according to the name of the Ethernet card on your computer (<code>em1</code> in this example</code>, which can be found by typing <code>ip a</code>. Common names include <code>eth0</code>, <code>eno1</code> and <code>em1</code>.
	* Once done, save the file: {{key press\|Ctrl\|X}}, {{key press\|Y}} then {{key press\|Enter}}.		* Once done, save the file: {{key press\|Ctrl\|X}}, {{key press\|Y}} then {{key press\|Enter}}.
			* Change the permissions so that the configuration file can only be accessed by superusers: <code>chmod 600 wg0.conf</code>

	== Start WireGuard ==		== Start WireGuard ==

Sam: Saved progress so far

2025-10-16T00:03:31Z

Saved progress so far

New page

WireGuard is a lightweight VPN server, built-in to the Linux kernel past kernel 5.6, making it very easy to set up on a Linux server. This guide will detail how to install on this server.

== Before you start ==

You will need to install the following packages:
* <code>openresolv</code> (for DNS resolution)
* <code>wireguard-tools</code>

=== Install the required packages ===

* Type <code>sudo zypper in openresolv wireguard-tools</code>
* Press {{key press|Y}} to accept

=== Allow IP forwarding ===

WireGuard requires IP forwarding to function as it will forward packets between your network adapter and a virtual adapter.

* Open a terminal window
* Move to <code>/etc</code> - <code>cd /etc</code>
* Open <code>sysctl.conf</code> for editing - <code>sudo nano sysctl.conf</code>
* Type your root password and press {{key press|Enter}}
* At the end of the file, type the following:
net.ipv4.ip_forward=1
* Press {{key press|Ctrl|X}} then {{key press|Y}} to save then {{key press|Enter}} to confirm saving the file
* Load the changes - <code>sysctl -p</code>

=== Restart the computer ===

* After completing the previous steps, restart the computer. This will active <code>openresolv</code> (no further configuration needed) and ensure IP forwarding is enabled. You are now ready to configure WireGuard.

=== Allow port forwarding on the router ===

* Port 33333 or whatever port you choose later must be port forwarded through your router. Ensure this is for UDP, '''NOT''' TCP.

== Configure the server ==

We will now configure the server settings for WireGuard. WireGuard comes complete with tools to create the the private/public keys needed to function and is configured with a simple configuration file.

For the following sets, you may need to become a superuser (<code>su</code>) to access the WireGuard folder.

* Become a superuser - <code>su</code>
* Type your root password and press {{key press|Enter}}. The terminal text should change to red to indicate you are now a superuser.
* Move to the WireGuard directory - <code>cd /etc/wireguard</code>

You will find this directory is empty - we will work in this directory which is secure.

* Create a private and public key for the server. You can use the following command:
wg genkey | tee server-privatekey | wg pubkey > server-publickey
**<code>server-privatekey</code> and <code>server-publickey</code> are filenames and can be anything you want and can be changed accordingly. These files are not directly used by WireGuard.

<div style="background:#FFEEEE;border:1px solid #FF0000;padding-left:5px;padding-right:5px;padding-bottom:5px;padding-top:5px;"> '''Warning'''

The private key generated should '''NEVER''' leave the server. Anyone with the private key can connect to and compromise the server. If the key does become compromised, a new private key should be generated and configured immediately and the old key never used again.

To keep private keys secure once used, it is advisable to store the private key somewhere offline and secure, away from the server. One example would be a USB stick. This way, if the server is compromised, it will be more difficult to compromise the private key. Ensure the permissions are correct as follows so that access is restricted to only superusers.

The public key is safe from compromise, this does not need to be stored with such security.

All private/public keys in this guide were generated as an example and are not in use on this server.
</div>

* Change the permissions of the private key so that only superusers can access the key: <code>chmod 600 server-privatekey</code>
* We need the private key to put in the configuration file: <code>cat server-privatekey</code>. This will display the key on the screen which can then be copied.
* We will create a configuration file with the same name as the interface WireGuard will create: <code>nano wg0.conf</code>
* Insert the following into the file:
[Interface]
## Local Address : A private IP address for wg0 interface.
Address = 10.20.10.1/24
ListenPort = 33333<br>
## local server privatekey
PrivateKey = iFFxF+gX39U9O4L4qt2mufTS441YWLu5WVt0mMPpLEA=<br>
## The PostUp will run when the WireGuard Server starts the virtual VPN tunnel.
## The PostDown rules run when the WireGuard Server stops the virtual VPN tunnel.
## Specify the command that allows traffic to leave the server and give the VPN clients access to the Internet.
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o em1 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -o em1 -j MASQUERADE
* Tweak the file to match your server configuration:
** <code>Address = 10.20.10.1/24</code> - this is the address used by the WireGuard interface and should be different from your local network subnet.
** <code>ListenPort = 33333</code> - 33333 is the default WireGuard network port but can be changed to anything you like as long as the port is not already in use by something else.
** <code>PrivateKey = iFFxF+gX39U9O4L4qt2mufTS441YWLu5WVt0mMPpLEA=</code> - Paste the key your generated and copied earlier.
** <code>PostUp = iptables -t nat -A POSTROUTING -o em1 -j MASQUERADE</code> and <code>PostDown = iptables -t nat -D POSTROUTING -o em1 -j MASQUERADE</code> - the interface needs changing according to the name of the Ethernet card on your computer (<code>em1</code> in this example</code>, which can be found by typing <code>ip a</code>. Common names include <code>eth0</code>, <code>eno1</code> and <code>em1</code>.
* Once done, save the file: {{key press|Ctrl|X}}, {{key press|Y}} then {{key press|Enter}}.

== Start WireGuard ==

* Type <code>systemctl start wg-quick@wg0</code> to start WireGuard.
** <code>wg0</code> is the name of the WireGuard interface and configuration file we created. If different, this should be changed to match the same name as the configuration file.
* Check that WireGuard is running: <code>wg show</code>. You should see something similar to the following if all is well:
interface: wg0
public key: 7IXE2Ej++JNHXDeP9mt9/N+OslIBmvOAREzCnT0v6To=
private key: (hidden)
listening port: 33333
* The public key should match the one generated earlier and can be viewed by typing <code>cat server-publickey</code>
* If you would like WireGuard to start on startup, type the following: <code>systemctl enable wg-quick@wg0</code>