How to Install WireGuard on Ubuntu: A Simple VPN Setup Guide

Quick Navigation

Difficulty: Beginner
Estimated Time: 15-25 minutes
Prerequisites: A server running Ubuntu 22.04, Basic knowledge of terminal commands, Root access or a user with sudo privileges

Introduction

In this tutorial, we'll go through a step-by-step process of installing WireGuard, a modern and fast VPN, on an Ubuntu 22.04 server. WireGuard is highly efficient, using state-of-the-art cryptography, and it's super easy to set up! Let's dive into setting up WireGuard on your server!

Prerequisites

• A server running Ubuntu 22.04
• Basic knowledge of terminal commands
• Root access or a user with sudo privileges

Step 1: Update and Install WireGuard

First, make sure your server's package list is up-to-date, then install WireGuard, along with essential networking tools.

sudo apt update
sudo apt install wireguard net-tools
sudo apt install resolvconf

Step 2: Generate Server Keys

WireGuard requires a public and private key pair for secure communication. Let's generate them:

Generate the Private Key:

wg genkey | sudo tee /etc/wireguard/private.key
sudo chmod go= /etc/wireguard/private.key

Your private key is safely generated and protected!

Generate the Public Key:

sudo cat /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key

Your public key is now ready to be shared!

Step 3: Configure the WireGuard Server

Create a new configuration file and paste in the generated private key:

sudo nano /etc/wireguard/wg0.conf

Add the following configuration, replacing base64_encoded_private_key_goes_here with your server's private key

[Interface]
PrivateKey = base64_encoded_private_key_goes_here
Address = 10.8.0.1/24
ListenPort = 51820
SaveConfig = true
PostUp = ufw route allow in on wg0 out on eth0
PostUp = iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE
PostUp = ip6tables -t nat -I POSTROUTING -o eth0 -j MASQUERADE
PreDown = ufw route delete allow in on wg0 out on eth0
PreDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
PreDown = ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Step 4: Enable IP Forwarding

To allow traffic forwarding through the VPN, enable IP forwarding:

sudo nano /etc/sysctl.conf

Uncomment or add the following lines:

net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1

Then apply the changes:

sudo sysctl -p

Step 5: Configure the Firewall

Ensure your firewall is configured to allow traffic on the WireGuard UDP port and SSH:

sudo ufw allow 51820/udp
sudo ufw allow OpenSSH
sudo ufw disable
sudo ufw enable

Check the firewall status:

sudo ufw status

Step 6: Enable WireGuard Service

Set the WireGuard service to start on boot and activate it:

sudo systemctl enable wg-quick@wg0.service
sudo systemctl start wg-quick@wg0.service

Step 7: Configure a WireGuard Peer

On the client machine, install WireGuard and generate a new key pair

sudo apt install wireguard
wg genkey | sudo tee /etc/wireguard/private.key
sudo chmod go= /etc/wireguard/private.key
sudo cat /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key

Next, configure the peer's settings, replacing the placeholders with your details:

sudo nano /etc/wireguard/wg0.conf

Add the following configuration:

[Interface]
PrivateKey = base64_encoded_peer_private_key_goes_here
Address = 10.8.0.2/24
PostUp = ip rule add table 200 from <peer_server_ip>
PostUp = ip route add table 200 default via <peer_server_gateway>
PreDown = ip rule delete table 200 from <peer_server_ip>
PreDown = ip route delete table 200 default via <peer_server_gateway>
[Peer]
PublicKey = server_public_key_goes_here
AllowedIPs = 0.0.0.0/0
Endpoint = server_public_ip:51820

Step 8: Connect and Test

To connect, run:

sudo wg-quick up wg0

Verify your VPN is working by checking the route:

ip route get 1.1.1.1

You should see output similar to:

1.1.1.1 dev wg0 table 51820 src 10.8.0.2 uid 1000

Conclusion

Congratulations! You've successfully set up WireGuard on your Ubuntu server. With WireGuard, you now have a secure and efficient VPN to keep your data safe. This setup is highly scalable, so feel free to add more peers or customize the configuration as needed. Happy networking!

Tags: #WireGuard #VPN #Ubuntu #NetworkSecurity #LinuxServer #Tutorial