Skip to main content

WireGuard

Keygen

Make private and public keys for client and for server (run twice).

Fish:

wg genkey | read F && echo $F && echo $F | wg pubkey

Bash:

wg genkey | while read F; do echo $F && echo $F | wg pubkey; done

Server

[Interface]
PrivateKey = <server: wg genkey>
MTU = 1340
ListenPort = <server port>
Address = 172.17.1.1/24
PostUp = iptables -A FORWARD -o vpn -i enp1s0 -j ACCEPT && iptables -A FORWARD -i vpn -o enp1s0 -j ACCEPT && iptables -t nat -A POSTROUTING -o enp1s0 -j MASQUERADE
PreDown = iptables -D FORWARD -o vpn -i enp1s0 -j ACCEPT && iptables -D FORWARD -i vpn -o enp1s0 -j ACCEPT && iptables -t nat -A POSTROUTING -o enp1s0 -j MASQUERADE

[Peer]
PublicKey = <client: wg pubkey>
AllowedIPs = 172.17.1.10/32
PersistentKeepalive = 300

Notes:

  • Write that in file /etc/wireguard/vpn.conf
  • Using enp1s0 as example default interface, edit as needed.

Client

[Interface]
PrivateKey = <client: wg genkey>
MTU = 1340
Address = 172.17.1.10/24
DNS = 172.17.1.1

[Peer]
PublicKey = <server: wg pubkey>
AllowedIPs = 0.0.0.0/0,::0/0
Endpoint = <server IP>:<serer port>

Notes:

  • Write that in file /etc/wireguard/vpn.conf

Start server/client

# From user (will ask for sudo password)
wg-quick up vpn

# As a service Void Linux
cd /var/service/
ln -s /etc/sv/wireguard

# As a service SystemD (e.g. Debian/Ubuntu)
sudo systemctl enable --now wg-quick@vpn

Back to top