Knowledgebase

How do I install and set up WireGuard VPN server on a Debian 10 Linux server? How can I configure Debian 10 as the WireGuard VPN server?

WireGuard is an open-source, free, modern, and fast VPN server with state-of-the-art cryptography. It is quicker and simpler as compared to IPSec and OpenVPN. Originally, released for the Linux kernel, but it is getting cross-platform support for other operating systems such as FreeBSD and others. This page explains how to install and set up WireGuard VPN on Debian 10 Linux server

Procedure: Debian 10 set up WireGuard VPN server

Our sample setup includes a simple peer connection between a cloud server running Debian 10 LTS server, and a Debian/Ubuntu/RHEL/SUSE/OpenSUSE/CentOS Linux desktop client (or iOS/Android app):

The steps are as follows for installing and configuring WireGuard on a Debian Linux 10 as a VPN server.

Please note that {vivek@mum-vpn:~ }$ OR {vivek@debian-10-vpn-client:~ }$ is my shell prompt and is not part of actual commands. In other words, you need to copy and paste command after my shell prompt.

Step 1 – Update your system

Run the apt command/apt-get command to install Debian 10 security updates:
{vivek@mum-vpn:~ }$ sudo apt update
{vivek@mum-vpn:~ }$ sudo apt upgrade

Step 2 – Enable Debian 10 buster backports repo

Wireguard is in Debian backported repo. Hence, enable backports as follows, run:
{vivek@mum-vpn:~ }$ sudo sh -c "echo 'deb http://deb.debian.org/debian buster-backports main contrib non-free' > /etc/apt/sources.list.d/buster-backports.list"
Use the cat command to verify repo:
{vivek@mum-vpn:~ }$ cat /etc/apt/sources.list.d/buster-backports.list
Update the repo, run:
{vivek@mum-vpn:~ }$ sudo apt update

Hit:1 http://mirrors.linode.com/debian buster InRelease
Hit:2 http://mirrors.linode.com/debian-security buster/updates InRelease
Hit:3 http://mirrors.linode.com/debian buster-updates InRelease
Get:4 http://deb.debian.org/debian buster-backports InRelease [46.7 kB]
Get:5 http://deb.debian.org/debian buster-backports/main amd64 Packages [292 kB]
Get:6 http://deb.debian.org/debian buster-backports/main Translation-en [227 kB]
Get:7 http://deb.debian.org/debian buster-backports/contrib amd64 Packages [7,448 B]
Get:8 http://deb.debian.org/debian buster-backports/contrib Translation-en [5,492 B]
Get:9 http://deb.debian.org/debian buster-backports/non-free amd64 Packages [23.3 kB]
Get:10 http://deb.debian.org/debian buster-backports/non-free Translation-en [30.3 kB]
Fetched 632 kB in 2s (287 kB/s)       
Reading package lists... Done
Building dependency tree       
Reading state information... Done
All packages are up to date.

Search for the WireGuard package

Run the following command:
{vivek@mum-vpn:~ }$ apt search wireguard

Sorting... Done
Full Text Search... Done
wireguard/buster-backports 1.0.20200319-1~bpo10+1 all
  fast, modern, secure kernel VPN tunnel (metapackage)
 
wireguard-dkms/buster-backports 0.0.20200318-1~bpo10+1 all
  fast, modern, secure kernel VPN tunnel (DKMS version)
 
wireguard-tools/buster-backports 1.0.20200319-1~bpo10+1 amd64
  fast, modern, secure kernel VPN tunnel (userland utilities)

Step 3 – Installing a WireGuard VPN server on Debian 10 LTS

Now, we got our server updates with the latest security patches and buster-backports is enabled. It is time for setting up a WireGuard VPN server on Debian 10 server. Enter:
{vivek@mum-vpn:~ }$ sudo apt install wireguard

Step 4 – Configuring WireGuard server

First we need to create a private and public key pair for the WireGuard server. Let us cd into /etc/wireguard/ directory using the cd command as follows:
{vivek@mum-vpn:~ }$ sudo -i
{root@mum-vpn:~ }# cd /etc/wireguard/
Execute the following command:
{vivek@mum-vpn:~ }# umask 077; wg genkey | tee privatekey | wg pubkey > publickey
To view keys created use the cat command and ls command:
{vivek@mum-vpn:~ }# ls -l privatekey publickey
{vivek@mum-vpn:~ }# cat privatekey
## Please note down the private key ##
{vivek@mum-vpn:~ }# cat publickey

Set Up WireGuard VPN on Debian by Editing wg0.conf

Edit or update the /etc/wireguard/wg0.conf file as follows:
{vivek@mum-vpn:~ }$ sudo nano /etc/wireguard/wg0.conf
## OR ##
{vivek@mum-vpn:~ }$ sudo vim /etc/wireguard/wg0.conf
Append the following config directives:

## Set Up WireGuard VPN on Debian By Editing/Creating wg0.conf File ##
[Interface]
## My VPN server private IP address ##
Address = 192.168.10.1/24
 
## My VPN server port ##
ListenPort = 51194
 
## VPN server's private key i.e. /etc/wireguard/privatekey ##
PrivateKey = eEvqkSJVw/7cGUEcJXmeHiNFDLBGOz8GpScshecvNHU
 
## Save and update this config file when a new peer (vpn client) added ##
SaveConfig = true

Save and close the file when using vim text editor.

Step 5 – Set up UFW firewall rules

I am assuming that you have UFW configured and we are going to open UDP 51194 port using the ufw command as follows:
{vivek@mum-vpn:~ }$ sudo ufw allow 51194/udp
Rule added
Rule added (v6)
See “How To Configure Firewall with UFW on Debian 10 LTS” for more info.

Step 6 – Enable and start WireGuard service

Turn the WireGuard service at boot time using the systemctl command, run:
{vivek@mum-vpn:~ }$ sudo systemctl enable wg-quick@wg0
Start the service, execute:
{vivek@mum-vpn:~ }$ sudo systemctl start wg-quick@wg0
Get the service status, run:
{vivek@mum-vpn:~ }$ sudo systemctl status wg-quick@wg0

Verify that interface named wg0 is up and running on Debian server using the ip command:
{vivek@mum-vpn:~ }$ sudo wg
{vivek@mum-vpn:~ }$ sudo ip a show wg0

Step 7 – Wireguard VPN client configuration

The procedure for installing and configuring a VPN client is the same as setting up the server. Let us install the client on an Debian Linux 10 desktop:
{vivek@debian-10-vpn-client:~ }$ sudo sh -c "echo 'deb http://deb.debian.org/debian buster-backports main contrib non-free' > /etc/apt/sources.list.d/buster-backports.list"
{vivek@debian-10-vpn-client:~ }$ sudo apt update
Install wireguard on Linux desktop, run:
{vivek@debian-10-vpn-client:~ }$ sudo apt install wireguard
Next we need create VPN client config on Debian/Debian/CentOS Linux destkop:
{vivek@debian-10-vpn-client:~ }$ sudo sh -c 'umask 077; touch /etc/wireguard/wg0.conf'
{vivek@debian-10-vpn-client:~ }$ sudo -i
{root@debian-10-vpn-client:~ }# cd /etc/wireguard/
{root@debian-10-vpn-client:~ }# umask 077; wg genkey | tee privatekey | wg pubkey > publickey
{root@debian-10-vpn-client:~ }# ls -l publickey privatekey
## Note down the privatekey ##
{root@debian-10-vpn-client:~ }# cat privatekey

Edit the /etc/wireguard/wg0.conf file:
{vivek@debian-10-vpn-client:~ }$ sudo nano /etc/wireguard/wg0.conf
## OR ##
{vivek@debian-10-vpn-client:~ }$ sudo vim /etc/wireguard/wg0.conf
Append the following directives:

[Interface]
## This Desktop/client's private key ##
PrivateKey = uJPzgCQ6WNlAUp3s5rabE/EVt1qYh3Ym01sx6oJI0V4
 
## Client ip address ##
Address = 192.168.10.2/24
 
[Peer]
## Debian 10 server public key ##
PublicKey = qdjdqh2pN3DEMDUDRob8K3bp9BZFJbT59fprBrl99zM
 
## set ACL ##
AllowedIPs = 192.168.10.0/24
 
## Your Debian 10 LTS server's public IPv4/IPv6 address and port ##
Endpoint = 172.105.112.120:51194
 
##  Key connection alive ##
PersistentKeepalive = 20

Enable and start VPN client/peer connection, run:
{vivek@debian-10-vpn-client:~ }$ sudo systemctl enable wg-quick@wg0
{vivek@debian-10-vpn-client:~ }$ sudo systemctl start wg-quick@wg0
{vivek@debian-10-vpn-client:~ }$ sudo systemctl status wg-quick@wg0

Allow desktop client and Debian server connection over VPN (peer)

We need to configure the server-side peer-to-peer VPN option and allow a connection between the Desktop client computer and the server. Let us go back to our Debian 10 LTS server and edit the wg0.conf file to add [Peer] (client) information as follows (type commands on your server box):
{vivek@mum-vpn:~ }$ sudo systemctl stop wg-quick@wg0
{vivek@mum-vpn:~ }$ sudo vi /etc/wireguard/wg0.conf
Append the following config:

[Peer]
## Desktop/client VPN public key ##
PublicKey = 2H8vRWKCrddLf8vPwwTLMfZcRhOj10UBdc0j8W7yQAk=
 
## client VPN IP address (note  the /32 subnet) ##
AllowedIPs = 192.168.10.2/32

Save and close the file. Next start the service again, run:
{vivek@mum-vpn:~ }$ sudo systemctl start wg-quick@wg0

Step 8 – Verification

That is all, folks. By now, both Debian servers and clients must be connected securely using a peer-to-peer VPN called WireGuard. Let us test the connection. Type the following ping command on your client machine/desktop system:
{vivek@debian-10-vpn-client:~ }$ ping -c 4 192.168.10.1
{vivek@debian-10-vpn-client:~ }$ sudo wg
## try to ssh into server using our VPN connection ##
{vivek@debian-10-vpn-client:~ }$ ssh vivek@192.168.10.1

Conclusion

Congratulation! You just learned about setting up a WireGuard VPN server on Debian 10 LTS server and peer (client machine) on both Debian/CentOS Linux desktop.