Table of Contents

Wireguard VPN

Installation

Linux: see Wireguard on Linux

create keys

cd /etc/wireguard
wg genkey | tee /dev/tty | wg pubkey
# or, if you want to output to file:
wg genkey | tee privkey | wg pubkey > pubkey

config

Server

/etc/wireguard/wg0.conf
[Interface]
PrivateKey = <server privkey>
Address    = <server address>/24
ListenPort = 5226
PostUp     = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -A FORWARD -i %i -j ACCEPT; ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown   = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -D FORWARD -i %i -j ACCEPT; ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
SaveConfig = true

Peer

/etc/wireguard/wg0.conf
[Interface]
Address = <peer IP address>/24
PrivateKey = <peer privkey>
 
[Peer]
PublicKey = <server pubkey>
Endpoint = <server IP or hostname>:5226
AllowedIPs = 0.0.0.0/0

add peer

wg set wg0 peer `cat clients/<peer>_public.key` allowed-ips <peer IP>/32

Tutorials

Public servers

Windows

There's a Kernel mode implementation since August 2021, which is enabled by default.

Tools