WireGuard

https://www.wireguard.com/
Admin
WireGuard is a fast, modern, and secure VPN tunnel that uses state-of-the-art cryptography and aims...
Tokens:32,322
Snippets:335
Trust Score:10
Update:5 days ago
Show doc for...
Tokens:
Raw
### Install WireGuard on OpenWRT

Source: https://www.wireguard.com/install

Install WireGuard on OpenWRT using opkg. Further installation and configuration instructions may be found on the wiki.

```bash
# opkg install wireguard

```

--------------------------------

### Install toolchain on OpenSUSE

Source: https://www.wireguard.com/compilation

Install required packages for compiling WireGuard on OpenSUSE using zypper.

```bash
$ sudo zypper install kernel-default-devel pkg-config

```

--------------------------------

### RHEL 7: Install WireGuard via ELRepo (Method 1)

Source: https://www.wireguard.com/install

Uses ELRepo's pre-built kmod-wireguard module. Requires installing EPEL and ELRepo release RPMs, then installing kmod-wireguard and wireguard-tools.

```bash
$ sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm https://www.elrepo.org/elrepo-release-7.el7.elrepo.noarch.rpm
$ sudo yum install kmod-wireguard wireguard-tools

```

--------------------------------

### Install WireGuard tools on Fedora

Source: https://www.wireguard.com/install

Install WireGuard tools on Fedora using dnf.

```bash
$ sudo dnf install wireguard-tools

```

--------------------------------

### Install WireGuard tools on Slackware

Source: https://www.wireguard.com/install

Install WireGuard tools on Slackware using slackpkg.

```bash
$ sudo slackpkg install wireguard-tools

```

--------------------------------

### Install WireGuard tools on OpenSUSE/SLE

Source: https://www.wireguard.com/install

Install WireGuard tools on OpenSUSE/SLE using zypper.

```bash
$ sudo zypper install wireguard-tools

```

--------------------------------

### Compile and install the wg(8) tool

Source: https://www.wireguard.com/compilation

Compile and install the wg(8) userspace tool from the wireguard-tools source.

```bash
$ make -C wireguard-tools/src -j$(nproc)
$ sudo make -C wireguard-tools/src install

```

--------------------------------

### Install WireGuard on Exherbo

Source: https://www.wireguard.com/install

Install WireGuard on Exherbo using cave.

```bash
# cave resolve -x wireguard

```

--------------------------------

### Install WireGuard tools on Mageia

Source: https://www.wireguard.com/install

Install WireGuard tools on Mageia using urpmi.

```bash
$ sudo urpmi wireguard-tools

```

--------------------------------

### CentOS 8: Install WireGuard via ELRepo (Method 2)

Source: https://www.wireguard.com/install

Uses ELRepo's pre-built kmod-wireguard module. Requires installing elrepo-release and epel-release, then installing kmod-wireguard and wireguard-tools.

```bash
$ sudo yum install elrepo-release epel-release
$ sudo yum install kmod-wireguard wireguard-tools

```

--------------------------------

### Install WireGuard on Ubuntu

Source: https://www.wireguard.com/install

Install WireGuard on Ubuntu using apt. Requires sudo privileges.

```bash
$ sudo apt install wireguard

```

--------------------------------

### Install WireGuard tools with Homebrew

Source: https://www.wireguard.com/install

Installs the WireGuard command-line tools on macOS using Homebrew. Requires Homebrew to be installed.

```bash
$ brew install wireguard-tools

```

--------------------------------

### Install WireGuard tools on Nix on Darwin

Source: https://www.wireguard.com/install

Install WireGuard tools on Nix on Darwin using nix-env.

```bash
$ nix-env -iA nixpkgs.wireguard-tools

```

--------------------------------

### Install toolchain on Fedora

Source: https://www.wireguard.com/compilation

Install required packages for compiling WireGuard on Fedora using dnf.

```bash
$ sudo dnf install elfutils-libelf-devel kernel-devel pkg-config @development-tools

```

--------------------------------

### Void: Install WireGuard via xbps-install

Source: https://www.wireguard.com/install

Installs the WireGuard tools and DKMS module using Void's package manager.

```bash
# xbps-install -S wireguard-tools wireguard-dkms

```

--------------------------------

### Install toolchain on Ubuntu/Debian

Source: https://www.wireguard.com/compilation

Install required packages for compiling WireGuard on Ubuntu or Debian. Uses apt-get to install libelf-dev, linux-headers, build-essential, and pkg-config.

```bash
$ sudo apt-get install libelf-dev linux-headers-$(uname -r) build-essential pkg-config

```

--------------------------------

### Install WireGuard tools on Alpine

Source: https://www.wireguard.com/install

Install WireGuard tools on Alpine using apk.

```bash
# apk add -U wireguard-tools

```

--------------------------------

### Install toolchain on Arch

Source: https://www.wireguard.com/compilation

Install required packages for compiling WireGuard on Arch Linux using pacman.

```bash
# pacman -S linux-headers base-devel pkg-config

```

--------------------------------

### OpenBSD: Install WireGuard tools via pkg_add

Source: https://www.wireguard.com/install

Installs the WireGuard tools package using OpenBSD's package manager.

```bash
# pkg_add wireguard-tools

```

--------------------------------

### Client configuration example

Source: https://www.wireguard.com/horrible-redirection-insanity

Example WireGuard client configuration with a private key, listen port, and a single peer (the server) with an endpoint and allowed IPs of 0.0.0.0/0, which acts as a wildcard for both sending and receiving.

```ini
[Interface]
PrivateKey = gI6EdUSYvn8ugXOt8QQD6Yc+JyiZxIhp3GInSWRfWGE=
ListenPort = 21841

[Peer]
PublicKey = HIgo9xNzJMWLKASShiTqIybxZ0U3wGLiUeJ1PKf8ykw=
Endpoint = 192.95.5.69:51820
AllowedIPs = 0.0.0.0/0

```

--------------------------------

### Install WireGuard on Debian

Source: https://www.wireguard.com/install

Install WireGuard on Debian using apt. Users with Debian releases older than Bullseye should enable backports.

```bash
# apt install wireguard

```

--------------------------------

### FreeBSD: Install WireGuard via pkg

Source: https://www.wireguard.com/install

Installs the WireGuard kernel module and tools using the FreeBSD package manager.

```bash
# pkg install wireguard

```

--------------------------------

### Install WireGuard tools on Gentoo

Source: https://www.wireguard.com/install

Install WireGuard tools on Gentoo using emerge. The wireguard-modules ebuild also exists for compatibility with older kernels.

```bash
# emerge wireguard-tools

```

--------------------------------

### Server configuration example

Source: https://www.wireguard.com/horrible-redirection-insanity

Example WireGuard server configuration with a private key, listen port, and multiple peers, each with a public key and allowed IPs. This configuration defines which client IPs are allowed into the tunnel and how outgoing packets are routed to peers.

```ini
[Interface]
PrivateKey = yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk=
ListenPort = 51820

[Peer]
PublicKey = xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=
AllowedIPs = 10.192.122.3/32, 10.192.124.1/24

[Peer]
PublicKey = TrMvSoP4jYQlY6RIzBgbssQqY3vxI2Pi+y71lOWWXX0=
AllowedIPs = 10.192.122.4/32, 192.168.0.0/16

[Peer]
PublicKey = gN65BkIKy1eCE9pP1wdc8ROUtkHLF2PfAqYdyYBz6EA=
AllowedIPs = 10.10.10.230/32

```

--------------------------------

### Install WireGuard on RHEL 8 via ELRepo

Source: https://www.wireguard.com/install

Method 1: Install WireGuard on RHEL 8 using ELRepo's pre-built module.

```bash
$ sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm https://www.elrepo.org/elrepo-release-8.el8.elrepo.noarch.rpm
$ sudo yum install kmod-wireguard wireguard-tools

```

--------------------------------

### Compile and install the kernel module

Source: https://www.wireguard.com/compilation

Compile and install the WireGuard kernel module from the wireguard-linux-compat source. Optionally run 'make debug' for additional dmesg information.

```bash
$ make -C wireguard-linux-compat/src -j$(nproc)
$ sudo make -C wireguard-linux-compat/src install

```

--------------------------------

### Install toolchain on Alpine

Source: https://www.wireguard.com/compilation

Install required packages for compiling WireGuard on Alpine Linux using apk. Use linux-vanilla-dev on a vanilla kernel.

```bash
# apk add build-base linux-hardened-dev  # or linux-vanilla-dev on a vanilla kernel

```

--------------------------------

### Termux: Install WireGuard tools via pkg

Source: https://www.wireguard.com/install

Installs the WireGuard tools package using Termux's package manager.

```bash
# pkg install wireguard-tools

```

--------------------------------

### EdgeOS: Install WireGuard via dpkg

Source: https://www.wireguard.com/install

Installs a prebuilt WireGuard .deb package downloaded from the release page. Replace {type} and {version} with the actual values.

```bash
$ sudo dpkg -i wireguard-{type}-{version}.deb

```

--------------------------------

### Install toolchain on RHEL/CentOS

Source: https://www.wireguard.com/compilation

Install required packages for compiling WireGuard on Red Hat Enterprise Linux or CentOS using yum.

```bash
$ sudo yum install elfutils-libelf-devel kernel-devel pkgconfig "@Development Tools"

```

--------------------------------

### RHEL 7: Install WireGuard via DKMS (Method 2)

Source: https://www.wireguard.com/install

For non-standard kernels, uses the DKMS package from the jdoss/wireguard COPR. Requires installing EPEL and adding the COPR repository.

```bash
$ sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
$ sudo curl -o /etc/yum.repos.d/jdoss-wireguard-epel-7.repo https://copr.fedorainfracloud.org/coprs/jdoss/wireguard/repo/epel-7/jdoss-wireguard-epel-7.repo
$ sudo yum install wireguard-dkms wireguard-tools

```

--------------------------------

### Install WireGuard on RHEL 8 via DKMS

Source: https://www.wireguard.com/install

Method 2: Install WireGuard on RHEL 8 using the DKMS package for non-standard kernels.

```bash
$ sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
$ sudo subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
$ sudo yum copr enable jdoss/wireguard
$ sudo yum install wireguard-dkms wireguard-tools

```

--------------------------------

### CentOS 7: Install WireGuard via kernel-plus (Method 1)

Source: https://www.wireguard.com/install

Installs a signed WireGuard module built into CentOS's kernel-plus. Requires enabling the centosplus repository and switching the default kernel to kernel-plus, then rebooting.

```bash
$ sudo yum install yum-utils epel-release
$ sudo yum-config-manager --setopt=centosplus.includepkgs=kernel-plus --enablerepo=centosplus --save
$ sudo sed -e 's/^DEFAULTKERNEL=kernel$/DEFAULTKERNEL=kernel-plus/' -i /etc/sysconfig/kernel
$ sudo yum install kernel-plus wireguard-tools
$ sudo reboot

```

--------------------------------

### CentOS 7: Install WireGuard via ELRepo (Method 2)

Source: https://www.wireguard.com/install

Uses ELRepo's pre-built kmod-wireguard module for users sticking with the standard kernel. Requires installing epel-release, elrepo-release, and yum-plugin-elrepo.

```bash
$ sudo yum install epel-release elrepo-release
$ sudo yum install yum-plugin-elrepo
$ sudo yum install kmod-wireguard wireguard-tools

```

--------------------------------

### Oracle Linux 7: Install WireGuard via UEK6

Source: https://www.wireguard.com/install

Installs wireguard-tools from the Oracle Linux Developer repository for UEK6. Disables the default ol7_developer repo and enables ol7_developer_UEKR6 with a package filter.

```bash
# yum install oraclelinux-developer-release-el7
# yum-config-manager --disable ol7_developer
# yum-config-manager --enable ol7_developer_UEKR6
# yum-config-manager --save --setopt=ol7_developer_UEKR6.includepkgs='wireguard-tools*'
# yum install wireguard-tools

```

--------------------------------

### CentOS 8: Install WireGuard via kernel-plus (Method 1)

Source: https://www.wireguard.com/install

Installs a signed WireGuard module built into CentOS's kernel-plus. Requires enabling the centosplus repository and switching the default kernel to kernel-plus-core, then rebooting.

```bash
$ sudo yum install yum-utils epel-release
$ sudo yum-config-manager --setopt=centosplus.includepkgs="kernel-plus, kernel-plus-*" --setopt=centosplus.enabled=1 --save
$ sudo sed -e 's/^DEFAULTKERNEL=kernel-core$/DEFAULTKERNEL=kernel-plus-core/' -i /etc/sysconfig/kernel
$ sudo yum install kernel-plus wireguard-tools
$ sudo reboot

```

--------------------------------

### Install WireGuard tools with MacPorts

Source: https://www.wireguard.com/install

Installs the WireGuard command-line tools on macOS using MacPorts. Requires MacPorts to be installed.

```bash
$ port install wireguard-tools

```

--------------------------------

### Run WireGuard demo client script

Source: https://www.wireguard.com/quickstart

Sets up interface wg0 using an insecure transport for demonstration purposes only.

```bash
$ sudo contrib/examples/ncat-client-server/client.sh

```

--------------------------------

### Configure physical devices in physical namespace

Source: https://www.wireguard.com/netns

Launches configuration tools (dhcpcd, wpa_supplicant) and assigns an IP address to eth0, all inside the 'physical' namespace using ip netns exec.

```bash
# ip netns exec physical dhcpcd wlan0
# ip netns exec physical wpa_supplicant -iwlan0 -c/etc/wpa_supplicant/wpa_supplicant.conf
# ip -n physical addr add 192.168.12.52/24 dev eth0

```

--------------------------------

### Install WireGuard tools on Oracle Linux 8

Source: https://www.wireguard.com/install

Install WireGuard tools on Oracle Linux 8 by enabling the UEKR6 repository and installing wireguard-tools.

```bash
# dnf install oraclelinux-developer-release-el8
# dnf config-manager --disable ol8_developer
# dnf config-manager --enable ol8_developer_UEKR6
# dnf config-manager --save --setopt=ol8_developer_UEKR6.includepkgs='wireguard-tools*'
# dnf install wireguard-tools

```

--------------------------------

### Test demo server with browser and ping

Source: https://www.wireguard.com/quickstart

Loads the hidden website and sends pings to the demo server.

```bash
$ chromium http://192.168.4.1
$ ping 192.168.4.1

```

--------------------------------

### Invoke wireguard-go to Create wg0 Interface

Source: https://www.wireguard.com/xplatform

Example invocation of a Go implementation to create a wg0 interface. This creates a virtual TUN device and daemonizes, then creates a UNIX domain socket at /var/run/wireguard/wg0.sock (or /run/wireguard/wg0.sock).

```bash
# wireguard-go wg0

```

--------------------------------

### List interfaces in physical and init namespaces

Source: https://www.wireguard.com/netns

Shows the interfaces in the 'physical' namespace (lo, eth0, wlan0) and the init namespace (only lo) after moving the physical interfaces. This verifies the namespace separation.

```bash
# ip -n physical link
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN mode DEFAULT group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT group default qlen 1000
    link/ether ab:cd:ef:g1:23:45 brd ff:ff:ff:ff:ff:ff
3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DORMANT group default qlen 1000
    link/ether 01:23:45:67:89:ab brd ff:ff:ff:ff:ff:ff

# ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

```

--------------------------------

### Verify wg0 in init namespace

Source: https://www.wireguard.com/netns

Shows the interfaces in the init namespace after moving wg0, confirming that wg0 is present and the physical interfaces are absent.

```bash
# ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
17: wg0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1423 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1
    link/none

```

--------------------------------

### Milis: Install WireGuard via mps

Source: https://www.wireguard.com/install

Installs the WireGuard tools and Linux compatibility module using Milis's package manager.

```bash
# mps kur wireguard-tools wireguard-linux-compat

```

--------------------------------

### Source Mage: Install WireGuard tools via cast

Source: https://www.wireguard.com/install

Installs the WireGuard tools using Source Mage's package manager.

```bash
# cast wireguard-tools

```

--------------------------------

### AstLinux: Enable WireGuard packages

Source: https://www.wireguard.com/install

Configuration options for AstLinux to enable the WireGuard kernel module and tools.

```makefile
BR2_PACKAGE_WIREGUARD_TOOLS=y
BR2_PACKAGE_WIREGUARD=y

```

--------------------------------

### Adélie Linux: Install WireGuard via apk

Source: https://www.wireguard.com/install

Installs the WireGuard tools and module using Adélie Linux's package manager.

```bash
# apk add wireguard-tools wireguard-module

```
Tokens:
Raw