WireGuard installation and configuration - on Linux

[@mikaylahopper1098]

I know this is old, but I've been stuck on setting up wireguard forever and this is the only video that worked for me. Never delete this!!

[@Wusaruful]

Important to also "sudo ufw allow 51820/udp" on server machine otherwise no connection. Awesome tutorial thanks saved me a lot of time

[@jaysinps]

Can I just even a little under 3ish years this is is the best wireguard setup video. Simple, short, straight to the point and still works.

[@christianlempa]

thank you so much :)

[@maxxmahh]

Be aware that Wireguard is UDP only. This can be a pretty big limitation if you are planning to use this over public networks like hotels, or public hotspots, since UDP can be simply blocked there and you will not be able to connect to your server (e.g. I can't connect to my home PC when I'm on my mobile hotspot, UDP gets blocked somewhere on the way to my router). Setting wireguard with TCP wrapping is a pain in the butt, and I wish Wireguard devs wouldn't be so stubborn and just supported both TCP and UDP out of the box for the users' convenience (I really don't buy their argument about performance, it is UDP or nothing, and I would agree on lower performance with TCP if the alternative is "nothing").

[@christianlempa]

Fair point! But watch my newest video, that is the solution to this: kzbin.info/www/bejne/gavcoJ-rbt6hZqc

[@novianindy887]

if it's UDP it means it's possible for packet loss to happen without retransmitting it??

[@pepperonieyed]

@@novianindy887 2 layers of TCP is not really useful and can lead to performance loss. VPNs generally should be UDP except in circumstances when UDP is blocked and you're forced to use TCP.

[@Ztaticify]

Who blocks udp? That would break so many applications, like anything that streams video

[@jtd_443]

Saved the day ! Changing "FORWARD -i %i" to "FORWARD -i wg0" solved problem with no LAN and internet access. THANKS !

[@christianlempa]

you're welcome friend :)

[@diabolist38]

Thank you very much. The narration is technical and simple, the details are well explained, the practical demonstration is extremely useful.

[@christianlempa]

Thank you! 😉

[@juanenriquestauffer5106]

WOW! The video was great. I understood completely the structure of how to configure. Thank you for that. What I didn't see in your video that would apply to my case is: a) If one peer connected to the server can ping or connect to another peer connected to the same server, and b) If the server can ping the client and connect for example through VNC to the client. Thanks!

[@christianlempa]

Thank you so much! :)

[@luizhp]

2 years later and you still saving lifes! 🥰

[@re_direct]

Finally! Thank you so much, I really struggled with configuring Wireguard for a while.

[@Julz2k]

I really like your voice, so germanish

[@christianlempa]

Haha thanks man 🇩🇪😎

[@ИванИванов-т7ь3х]

Your guide helped me to finally configure WireGuard without an issue, except I needed to upgrade my Kernel from 5.4.* to 5.7.*, which was not obvious from the beginning. Now I need to teach WG to mimic http/s traffic, because my mobile carrier doesn't like any traffic except http/s. Keep filming more videos, dude.

[@christianlempa]

Thank you! That's pretty interesting, I suppose you needed to change the WG port to 443 or did you need to make any additional changes?

[@ИванИванов-т7ь3х]

@@christianlempa At the very basic, yes. Unfortunately, unlike OpenVPN, WireGuard is not deigned to obfuscate traffic and fool DPI, it's a known limitation www.wireguard.com/known-limitations/. I need some workaround to achieve it, most likely with some third party tool. It'll be grade if you make a video about this topic sometime in the future

[@christianlempa]

@@ИванИванов-т7ь3х thanks for sharing this. I'll have a look into that because that's a topic I'm also interested in a lot!

[@szymonandrzejewski6087]

Thank you, for your help. My mini-project at my university is done thanks to you :)

[@swcodfather]

Whilst setting this up it is worth noting on the server side the iptables mentions "eth0" - however on virtual machines this can be enp0s3 or on new ubuntu servers eno1 - or another number depending on the number of interfaces you have. Hope this saves others time :-)

[@christianlempa]

thanks for highlighting this! 😉

[@AKaptijn94]

This video deserves more views. Excellent walkthrough.

[@christianlempa]

Thank you so much! And yes, I agree with you :D

[@RonVichar]

probably one of the best videos on this topic even though wireguard has changed slightly it does take longer than 18 minutes to setup the first time LOL :XD

[@christianlempa]

Thank you so much :D

[@pndungu1]

This video has clearly explained what I have researched for a long time. I have made some dollars as well from a client. Thank you, Christian.

[@christianlempa]

Thanks! Glad it helped you 👍

[@ahmedshamz]

Thank you! The best installation guide on WG ever..

[@namesurname9201]

Christian! Thank you very much for your video! I could set up wireguard between routerOS and Ubuntu only after watching that :)

[@jimcatan703]

Even better than the official wireguard tutorial. Viel'n Dank, Kumpel!

[@cristobaljvp]

Thank you so much, I was so lost configuring the client and it was so easy following your tutorial. Definitely suscribed!

[@christianlempa]

Glad it helped!

[@djonsmith1880]

"I think, that is not too complicated..." You know what is not too complicated? My thinking processes. As for THIS... Аnyway, great video, sir! My tunnel works as swiss watch now! Subscribed.

[@christianlempa]

Great to hear I could help you and it's working! 😋

[@cheebadigga4092]

Thank you!! That ipv4 forward thing was exactly what I needed. Finally I can use WG instead of OpenVPN! :)

[@crazyoptimist4540]

Doing this using docker compose, I want that video which will be helpful for docker fans!

[@christianlempa]

I saw you found it already 😊 cheers!

[@crazyoptimist4540]

Loved this very much! A network pro!

[@null_carrier]

Thank you so much for this excellent tutorial.

[@christianlempa]

Glad it was helpful!

[@giovanniguarino588]

Congratulation - Clear explaination

[@christianlempa]

Glad it was helpful!

[@dsareb267]

Did it work for you? Did you write all the commands as is without changing anything?

[@carlosdedo]

Very clear and complete tutorial, thanks.

[@christianlempa]

Glad it was helpful!

[@Pixelblurr]

For those like me who are very new to Linux and had no idea how he saved the file, hit esc, then :w to write it. This is the biggest hurdle for linux to overcome. EVERY tutorial requires a dozen searches to figure out stuff they THINK is common knowledge. By the end of it most give up and go back to windows. I'd love to switch over, and everytime I've tried, I've learned some new things, but the amount I have to figure out by searching WHILE watching tutorials/guides cause they don't explain it is astounding. The Linux community needs to stop thinking everyone has been using linux for 10 years if they want to see more people make the switch.

[@tuanvu01]

Thank you so much, after look your video i already tried success

[@nataalves6194]

Thank you very much, this saved me from madness

[@christianlempa]

Glad it helped!

[@إرتقاءسوفت]

from Syria , best require

[@funnysystemadministrationb3645]

Thank you for this video. I will try on RHEL8 now.

[@christianlempa]

Nice! You're welcome ;)

[@raul230285]

Nice video. Saludos desde Perú.

[@christianlempa]

Thank you man!

[@cr3at0rgamer67]

Thank you soo much. This helped me a lot. Keep this good work up!

[@christianlempa]

Thank you! :)

[@zaur66]

Another great video from you ! Well explained, thank you for this !

[@christianlempa]

Thank you mate! :)

[@iamlegion990]

This is a great video ... explained perfectly

[@christianlempa]

Thanks 😊

[@dawid999920]

Great explanation, thank you

[@MarcelHuguenin]

Excellent tutorial, very clear and concise. I went along and it worked perfectly. Did the setup in my Proxmox virtual environment. Now need to experiment further. Thank you!

[@christianlempa]

Thank you so much! :) Keep on experimenting :D

[@linhnguyen-ns3mm]

very quality lession, keep up hardwork, i'm in :D

[@christianlempa]

Thanks, will do!

[@irtibatkisileri222]

how nicely put tutorial. Thanks. Subscribed.

[@christianlempa]

Thanks ;)

[@anton1284]

Great video bro, thanks Gran video bro, gracias.

[@hugomcm1]

Great stuff, thanks a lot

[@DominicUliano]

Thank you. Very good Video. It was very helpful

[@christianlempa]

I'm glad it helped 😊

[@tamerbakr666]

waw an fantastic thanks for your effort

[@christianlempa]

So nice of you

[@azzamsya]

Excellent video!

[@christianlempa]

Thank you very much!

[@i3xt3blackeagle]

Hello, this has worked wonderfully with my laptop, the same general client configuration would work if I apply it to a raspberry pi as a VPN router?

[@Grid21]

Hello, do you happen to have any videos about setting up WireGuard on TrueNAS? Because I really need some step by step guide on how to do that. Please and thank you. :)

[@AM-dpznd]

Big thankss for this tutorial 👍👍👍

[@christianlempa]

Thank you! ☺️

[@VorpalForceField]

very nice tutorial ... TY :)

[@christianlempa]

Glad it was helpful!

[@robgrune3284]

excellent.

[@pedrofigueira4858]

Good video my friend! You saved us, i wish god can pay you, cause i can't!💪

[@christianlempa]

Thank you!

[@CHLEE-ou6ub]

Good day Christian, Was thinking if you can consider doing a video on Wireguard Docker Site-to-Site, specifically Home Server to VPS always-on Wireguard Tunnel ? Many Thanks in advance.

[@slark131]

thanks a lot !

[@jheinemberjimenez5564]

🎯 Key points for quick navigation: 00:00 *Installing WireGuard VPN* 00:37 *New VPN protocol* 01:19 *Ubuntu compatibility demo* 02:01 *Easy package installation* 02:56 *Generate keys command* 04:18 *Sensitive private key* 05:06 *Configure tunnel interface* 06:15 *Change default gateway* 08:21 *Public key setup* 09:38 *Traffic routing setup* 10:52 *Enable packet forwarding* 12:38 *Persistent keepalive packets* 13:52 *Connectivity test success* 15:32 *Capture network packets* 16:44 *Configure custom routing* Made with HARPA AI

[@olomier]

Hi Christian, love your tutorials these are very helpful. I'm wondering, is it gonna work if I set up tunel like in your video to connect remotely to my PC with ubuntu from different network? The problem is that my router changing the IP, it's not static. If you have any tip, please share :)

[@youngveli50]

I have followed your tuto, but at the end, I SSH is not responding...

[@rusttaf]

Thanks for this video it is really helpful. I learned that tunnel must be started after each system start. Could you please guide me how to start tunnel automatically? Thanks!

[@christianlempa]

I'm glad it helps you :) Sure you can simply add the wg0 interface to systemd: sudo systemctl enable --now [e-mail]

[@chebalid7524]

Kudos.. Could you possibly do a video about Wireguard with udp hole punching... Or recommend a working open source VPN that implements udp hole punching

[@christianlempa]

Thanks for the good suggestion. I just solved this with DNAT rules and Keep-Alive packets, but I'll have look into this

[@enredao_electronico2737]

Very well explained. I’m a newbie , Wondering how to implement this approach for 2 IPPBX one in LAN the other one in the cloud . Server at cloud same IPPBx ? Client at premises ? Any hint ?

[@christianlempa]

Thanks! It should work well with any Protocol, so give it a try 😁

[@mariomazzola4243]

Man you rally made my day! I had been struggling with openvpn for a while... But with your video i could set up wireguard in no time. Thanks!!!

[@christianlempa]

Thanks man 😊, I'm glad it helped you!

[@morcat]

BIG THANX ❤

[@christianlempa]

You're welcome 😀

[@Monkore]

very good

[@christianlempa]

Thank you! Cheers!

[@youngveli50]

please explain if there is differencies in configuring the wireguard server on centos

[@provide7940]

I did everything up to 6:50 on my cloud VPS server where Ubuntu 20.04 is installed. Then you switched to the client on another Linux Ubuntu. I need my Windows clients to have Windows and not Linux working. How should I create configs for the Windows client then?

[@loulax3561]

Hey thanks for your videos ! :) Where can i find the top menu on your windows where displayed cpu informations .. ??

[@christianlempa]

It's a rainmeter plugin you can find on my github dotfiles repository

[@loulax3561]

@@christianlempa Ok thanks

[@djordje1999]

im having trouble to run openvpn as so this is perfect alternative for that..

[@Toffee_tech_tee]

Hello, really good video there by the way. You mentioned about doing a video on public and private keys but i cant find it anywhere. Have you done one?

[@christianlempa]

Hey, thank you man! :) That's covered in my SSH auth video: kzbin.info/www/bejne/i5DYmomve5uAe9U

[@Toffee_tech_tee]

@@christianlempa Perfect, what's even better about your videos like on this one is following your blog so you can literally just copy and paste commands

[@christianlempa]

Thank you! That's great to hear :)

[@giovanniguarino588]

Hello Christian I would like to route all the traffic that enter in wireguard to mitmproxy, but not only web traffic, tcp, udp and others?

[@adanjsuarez]

Thanks!

[@daguard411]

Forgive me, I have tried what you have in this episode, and I have no doubt that you are doing what is correct, it just isn't as easy for me. I am running pclinuxos 2022 MATE, could I trouble you for a link to a step by step guide for this system?

[@blackbarry45]

awesome

[@philconners8871]

Where does the "fwmark: 0xca6c" suddenly come from? It appears out of nowhere at 10:57

[@Arma-n]

What app did you use to run the servers? Beside the WireGuard

[@pedro_8240]

You forgot the part where you put the allowed peers in the server configuration, so that when you reboot the server the peers can connect again. The way you showed, the peer entries in the server are only temporary and are lost after a reboot.

[@christianlempa]

Thx for letting me know!

[@svenvanham]

How do I do that

[@mateus_barcelos]

Ty

[@JHL0L]

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;

[@overcomer_media]

Thank you a lot for great tutorial I watched it and did as you said and was able to run it on my linux client but no success on windows Would you plz created another tutorial for windows clients and a bit of help about the dns settings and what should we do to get dns requests straight from von server

[@christianlempa]

Thanks for the reply :) Yea may be a good idea, let me do a quick video about it soon!

[@mikrotikpakistan1630]

hi i am using mikrotik to mikrotik wireguard tunnel but when my client side mikrotik reboot due to any reason my tunnels can reconnect automaticly i need to change public key and re submit in server side to reconnect my tunnel again Please help me in this regard . am also using change mss rule in mangle /ip firewall mangle add action=change-mss chain=forward new-mss=clamp-to-pmtu passthrough=yes \ protocol=tcp tcp-flags=syn

[@user-bc7fm]

@15:00 Can't I just edit the "ip_forward" file and change the value to from 0 to 1?

[@mapdmartin]

will also all of my Ipv6 traffic be routed through this vpn tunnel? or is in this configuration an ipv6 leak possible?

[@christianlempa]

You can also configure IPv6 addresses in the config files.

[@lineways5477]

Does this even support layer 2 tunnels like openvpn? I don't think so... Does it support that the traffic cannot even be decrypted later on with the key like ipsec does? I don't think so...

[@PoeLemic]

Liked the video, but I have a conceptual problem. Okay, it seems to me like you are setting up VPN between client and server locally behind your router. Right? Well, your network traffic would be encrypted between those two computers. But it doesn't get encrypted going from your router to the rest of internet. Right? So, are you just trying to protect your network packets from being sniffed by something like WireShark (which I used in a class before -- to demonstrate capturing certain packets). Maybe, this is an idea for a followup video. For me, I'd like to setup VPN on something (say like a future Pfsense box) that would encrypt my communications and not allow the Internet Provider to monitor what I am doing. Would WireGuard do that for me? Okay, hope that isn't too long of a question.

[@christianlempa]

Hey there, you're absolutely right. In this video I'm setting up this in a local test environment. I often do that to demonstrate how it works in general so you can adopt this to whatever your use case is. With a VPN the packets are only encrypted between your client and server. I've lately done a follow up video how to set up a private VPN server with WireGuard in a docker container. There I explain this further and where to set up this and how you could use it. However, you need to be aware of the limitations VPN has and why it is not a way to protect yourself from the public internet. You may also have a look at other techniques like DoH to encrypt your DNS queries and how encryption like HTTPS works in general. Thank you also for the suggestion with WireShark, that's definitely something I will cover in upcoming videos 🙂!

[@sergiucusnir6206]

hi there, can you give examples how can i access internet via browsers ? it gives me "dns probe finished bad config", thx

[@BrandonSu-y2l]

Hey I am currently trying to get the peer connection to show up on the interface for wg0, I tried every single address from the ip addr command. Please help when you can thanks!

[@TheOlderIget]

Hi, I installed wireguard on 2 servers and the conf file setup is quite simple. That being said, I cannot ping from master to peer or peer to master using the interface I setup. I used a 10.X.X.X like your example What should I be looking at on the physical server that may not be configured correctly? I also shutdown the firewall and still the ping failed

[@Morpheus2515]

Great video . Do you know how to bypass certain services as client to the server ? Lets say I dont want a port like 54321 routed via Wireguard . :)

[@christianlempa]

Thanks! Well I guess you'd need a more customized IPTables ruleset for that. It's possible, but needs some customization.

[@confusedbaguette1416]

Thank you for such an amazing video! It really made it a lot easier to set things up. However, I have an issue. Everything is working just as it does for you in the video, only I cannot seem to be able to ping neither the server nor any other IP addresses. I have tried a few things, but cannot figure it out. Do you maybe have any ideas? Thank you in advance!

[@confusedbaguette1416]

The handshake works, but not ping

[@christianlempa]

Thank you ☺️, check if you have set up the IPtable rules correctly and if set up the IP addresses. Hard to tell without checking your config, so if you have still issues, why not join our discord and share your config, that will help a lot 😊

[@confusedbaguette1416]

@@christianlempa Thank you so much for such a quick response! I will check the IPtable rules first and if that does not help, then I will certainly have to join Discord 😁

[@aidennymes6335]

how can i configure the server so it forwards all incoming request on wg0 to all the connected peers in the same subnet of that interface? that's so i can have communication between every peer within 10.0.0.X

[@mimaba6444]

Thank you very much for the straight forward guide. I really appreciate it and I already signed up for your channel! Do you have any idea what this error means? I am trying to run Wireguard on a Ubuntu 20.04 Container in Proxmox [#] ip link add wg0 type wireguard Error: Unknown device type. Unable to access interface: Protocol not supported [#] ip link delete dev wg0 Cannot find device "wg0"

[@christianlempa]

Thank's 😀, the issue you describe appears if the wireguard kernel modules are not loaded correctly. This usually occurs when the Linux distro you're using doesn't use a newer kernel version where the drivers are already included and it's not able to build the kernel module with the sourcefiles (such as might happen on shared VPS servers without direct access to the kernel). The issue can also occur when there is an outstanding kernel upgrade that hasn't been installed, yet. Try to update your packages, reboot your machine and try installing wireguard again. I hope this helps

[@mimaba6444]

@@christianlempa Vielen Dank! I think that is it. Looks like Proxmox is currently running under 5.4.34 Kernel. I guess I will try installing Wireguard once they moved to 5.6. Until that day I will try to learn from all your other videos!

[@dimitristsoutsouras2712]

At 5:53 while you are creating the rules in /etc/wireguard/wg0.conf file.... the eth0 should correspond to anyones adapter? For instance someone else should put there enp2s0 if that is his adapter giving him connection to net or eth0 is the name of the virtual adapter upon which wireguard will run? What if the server's adapter is also setup on eth0? Shouldn t be a conflict there? Also if the client OS is windows, the client gui also has an add a wireguard file option. Nothing else to generate those keys to put it back on the server side ... so is this situation viable only when both server and client using Linux OS? PS PIvpn has a scrip which makes the process wayyyyyyyyyyyyyyyy more easy than all this procedure. And the server generates everything. Client only imports the key and connect and thats it. Thank you

[@CProton69]

Well configuring the interface my server suddenly shutdown then had a weird garbled graphic on reboot. I've tried setting this up already but as soon as I activated the client my terminal to ubuntu server suddenly disconnects and I cannot connect to any websites. What am I doing wrong? And now my server PC just shuts down while adding the wg0.config. I obviously cannot install this properly as my PC just shutdown again while editing the wg0.conf file.

[@mikaylahopper1098]

For me, this works and packets can be traced but it blocks the internet connection on my client VM (server is physical machine and can access internet fine). How to fix this?

[@bgpengu]

Wie hast du die Leiste mit der Auslastung oben hinbekommen? Die sieht so schön aus.

[@christianlempa]

Danke :) das ist rainmeter

[@bgpengu]

@@christianlempa Dürfte ich Fragen, welcher Skin das ist? Ich suche so ähnliche Rainmeter Skins aber kann nichts finden.

[@christianlempa]

@@bgpengu Klar, den Skin findest du in meinem GitHub: github.com/xcad2k/dotfiles/tree/main/Windows/Rainmeter/Skins/xcad

[@bgpengu]

@@christianlempa Hast du diesen Skin selbst geschrieben?

[@christianlempa]

@@bgpengu Ich hab das von einer Vorlage editiert, allerdings benutze ich den aktuell nicht mehr, da er immer von den Fenstern verdeckt wird und in Windows man das nicht so gut einstellen kann dass der Platz frei wäre. Aber wenn du ihn magst kannst du ihn natürlich gern verwenden und eventuell auch weiter editieren ;)

[@rishipareek4522]

Could you please help me , I need to set it up on my vps and synology nas so that I might setup a plex server accessible outside my home network as my isp blocks all ports and ip is dynamic with double NAT thanks

[@sportslovers9162]

You are created double file /etc/wg0.conf i dont understand help me

[@itzsleazy6903]

Hi I love how simple you made tutorial to follow, the official WireGuard site on the otherhand left me confused. Sadly I can't get this to work for 4g between my phone and PC. I can't find much info on this do you have any idea how I can get this to work? I also tried using tailscale but the app never allowed my phone(LineageOS) to be the endpoint.

[@christianlempa]

Thank you for the feedback. Well I'm not sure about the problem, can you share some details on our discord? Maybe we can help you

[@itzsleazy6903]

@@christianlempa Sure, I'll give it a try :)

[@ChefEarthenware]

Did you ever get this to work? I've been trying to get Wireguard to work over a 4G connection for weeks without success.

[@itzsleazy6903]

@@ChefEarthenware Sadly not. I think it has to do with a) finding a way to port forward and b) finding the correct address for your private IP. I went into Termux(Console for android, I recon adb would be the same) to figure it out. For "a)", I really couldn't find anything online for this. For "b)", there are multiple transmitters, each with their own private IPs but also like a virtual one that acts as an overall switch(I think, can't remember exactly sry). There are commands to change your private IP also. I struggled finding anything onlinr for using a phone as an endpoint :( Hope you have better luck :) p.s. got zero replys on the discord

[@ChefEarthenware]

@@itzsleazy6903 Thanks for the reply. I've been beginning to think that Wireguard is not able to meet my requirement. I've tried loads of online examples, but none work for me. The only example I've seen which matches my requirement uses SSH tunnelling, so I think I'll give that a try instead.

[@abdirizakabdulkader3571]

Excellent tutorial, Danke. The second time I generated pub/privatekey for the client and tried to run this command "sudo vim /etc/wireguard/wg0.conf" to be able to write the next configuration, it pop up the old vim file where I wrote things about server, so there is where I lost the track. Help plz.

[@christianlempa]

Np mate! Have you checked out our Discord for help?

[@DanieleCalecaDATASERVICE]

very powerful, i need one hand. i have a remote camera rear a snat unreachable ip, have installed a server on gcp and client on raspberry. from my pc i reach raspberry. but i want to make a routing to reach a camera subnet directly, how make this routing? very tnx

[@joebleau202]

Everything was going good until the last part. Setting up forwarding. It seems to revert back to 0 and not allow up forwarding. Any ideas as to why? How can I make this change persistent?

[@christianlempa]

Thanks for giving me a heads up. You need to make the changes persistent in the: /etc/sysctl.conf file. For some reason I forgot it in this video :/

[@daxcor]

Ok this was awesome. It all works flawlessly. However I have to wg set after I reboot the box. Is there a way to make this active on reboot, or do I just run script at boot?

[@daxcor]

Yeah figured it out.. just have to read the docs.

[@christianlempa]

Thanks! Sorry havent got to the question but glad you found it out :)