WireGuard — VPN on keys

Q: The tunnel is up, but there's no connectivity

sudo wg show — is there a "latest handshake"? No handshake means the keys don't match, the Endpoint is wrong, or port 51820/udp is closed by the firewall on the server.

Q: There's a handshake, but pings don't go through

AllowedIPs doesn't include the needed addresses (for each peer, it's "which IPs are behind it"). For routing outward, add ip_forward plus NAT.

Q: Can't connect after a reboot

systemctl enable wg-quick@wg0. Check wg-quick up manually for errors.

Q: Asymmetric / one side sees the other, but not vice versa

AllowedIPs must be configured consistently on both sides. One side's public key must be in the other's [Peer] section.

4 min Ubuntu 24.04 · WireGuard

A fast VPN on a key pair instead of passwords; the private key in wg0.conf needs permissions, like an SSH key.

Cheat sheet

5 commands Printable version

wg genkey | tee priv | wg pubkey > pub generate keys
sudo wg-quick up wg0 bring the tunnel up
sudo wg-quick down wg0 bring the tunnel down
sudo wg show peers, handshake, traffic
sudo systemctl enable wg-quick@wg0 autostart
conf: [Interface] Address/PrivateKey/ListenPort ; [Peer] PublicKey/AllowedIPs/Endpoint

Overview

WireGuard is a simple, fast VPN built on keys (like SSH: a private/public pair). It creates a wg0 interface with an encrypted tunnel between peers. Managed with wg/wg-quick.

bash

sudo apt install wireguard
wg genkey | tee privatekey | wg pubkey > publickey   # a key pair

Options

/etc/wireguard/wg0.conf:

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <your private key>

[Peer]
PublicKey = <the peer's public key>
AllowedIPs = 10.8.0.2/32        # which addresses to route through the tunnel
# Endpoint = host:51820         # for a client — the server's address

bash

sudo wg-quick up wg0             # bring the tunnel up
sudo wg-quick down wg0           # bring it down
sudo systemctl enable wg-quick@wg0   # autostart

For routing/exiting through the VPN, enable forwarding (sysctl net.ipv4.ip_forward=1) and NAT in firewall.

Troubleshooting

The tunnel is up, but there's no connectivity

sudo wg show — is there a "latest handshake"? No handshake means the keys don't match, the Endpoint is wrong, or port 51820/udp is closed by the firewall on the server.

There's a handshake, but pings don't go through

AllowedIPs doesn't include the needed addresses (for each peer, it's "which IPs are behind it"). For routing outward, add ip_forward plus NAT.

Can't connect after a reboot

systemctl enable wg-quick@wg0. Check wg-quick up manually for errors.

Asymmetric / one side sees the other, but not vice versa

AllowedIPs must be configured consistently on both sides. One side's public key must be in the other's [Peer] section.

Danger zone

wg0.conf contains the private key in plain text — the file must be readable only by root (chmod 600, owned by root, which is also the default wg genkey produces when redirected into a file). A leaked private key is equivalent to a leaked password: with it, someone can stand up their own node with the same public key inside the network. Don't commit a wg0.conf with real keys to git, and don't send it in a shared chat — sharing the public key with a new peer only needs wg pubkey.