How do I install and set up WireGuard VPN server on a Debian 10 Linux server? How can I configure Debian 10 as the WireGuard VPN server?
WireGuard is an open-source, free, modern, and fast VPN server with state-of-the-art cryptography. It is quicker and simpler as compared to IPSec and OpenVPN. Originally, released for the Linux kernel, but it is getting cross-platform support for other operating systems such as FreeBSD and others. This page explains how to install and set up WireGuard VPN on Debian 10 Linux server
Procedure: Debian 10 set up WireGuard VPN server
Our sample setup includes a simple peer connection between a cloud server running Debian 10 LTS server, and a Debian/Ubuntu/RHEL/SUSE/OpenSUSE/CentOS Linux desktop client (or iOS/Android app):
The steps are as follows for installing and configuring WireGuard on a Debian Linux 10 as a VPN server.
Please note that {vivek@mum-vpn:~ }$ OR {vivek@debian-10-vpn-client:~ }$ is my shell prompt and is not part of actual commands. In other words, you need to copy and paste command after my shell prompt.
Step 1 – Update your system
Run the apt command/apt-get command to install Debian 10 security updates:{vivek@mum-vpn:~ }$ sudo apt update
{vivek@mum-vpn:~ }$ sudo apt upgrade
Step 2 – Enable Debian 10 buster backports repo
Wireguard is in Debian backported repo. Hence, enable backports as follows, run:{vivek@mum-vpn:~ }$
sudo sh -c "echo 'deb http://deb.debian.org/debian buster-backports main
contrib non-free' > /etc/apt/sources.list.d/buster-backports.list"
Use the cat command to verify repo:{vivek@mum-vpn:~ }$ cat /etc/apt/sources.list.d/buster-backports.list
Update the repo, run:{vivek@mum-vpn:~ }$ sudo apt update
Hit:1 http://mirrors.linode.com/debian buster InRelease Hit:2 http://mirrors.linode.com/debian-security buster/updates InRelease Hit:3 http://mirrors.linode.com/debian buster-updates InRelease Get:4 http://deb.debian.org/debian buster-backports InRelease [46.7 kB] Get:5 http://deb.debian.org/debian buster-backports/main amd64 Packages [292 kB] Get:6 http://deb.debian.org/debian buster-backports/main Translation-en [227 kB] Get:7 http://deb.debian.org/debian buster-backports/contrib amd64 Packages [7,448 B] Get:8 http://deb.debian.org/debian buster-backports/contrib Translation-en [5,492 B] Get:9 http://deb.debian.org/debian buster-backports/non-free amd64 Packages [23.3 kB] Get:10 http://deb.debian.org/debian buster-backports/non-free Translation-en [30.3 kB] Fetched 632 kB in 2s (287 kB/s) Reading package lists... Done Building dependency tree Reading state information... Done All packages are up to date. |
Search for the WireGuard package
Run the following command:{vivek@mum-vpn:~ }$ apt search wireguard
Sorting... Done Full Text Search... Done wireguard/buster-backports 1.0.20200319-1~bpo10+1 all fast, modern, secure kernel VPN tunnel (metapackage) wireguard-dkms/buster-backports 0.0.20200318-1~bpo10+1 all fast, modern, secure kernel VPN tunnel (DKMS version) wireguard-tools/buster-backports 1.0.20200319-1~bpo10+1 amd64 fast, modern, secure kernel VPN tunnel (userland utilities) |
Step 3 – Installing a WireGuard VPN server on Debian 10 LTS
Now, we got our server updates with the latest security patches and buster-backports is enabled. It is time for setting up a WireGuard VPN server on Debian 10 server. Enter:{vivek@mum-vpn:~ }$ sudo apt install wireguard
Step 4 – Configuring WireGuard server
First we need to create a private and public key pair for the WireGuard server. Let us cd into /etc/wireguard/ directory using the cd command as follows:{vivek@mum-vpn:~ }$ sudo -i
{root@mum-vpn:~ }# cd /etc/wireguard/
Execute the following command:{vivek@mum-vpn:~ }# umask 077; wg genkey | tee privatekey | wg pubkey > publickey
To view keys created use the cat command and ls command:{vivek@mum-vpn:~ }# ls -l privatekey publickey
{vivek@mum-vpn:~ }# cat privatekey
## Please note down the private key ##
{vivek@mum-vpn:~ }# cat publickey
Set Up WireGuard VPN on Debian by Editing wg0.conf
Edit or update the /etc/wireguard/wg0.conf file as follows:{vivek@mum-vpn:~ }$ sudo nano /etc/wireguard/wg0.conf
## OR ##
{vivek@mum-vpn:~ }$ sudo vim /etc/wireguard/wg0.conf
Append the following config directives:
## Set Up WireGuard VPN on Debian By Editing/Creating wg0.conf File ## [Interface] ## My VPN server private IP address ## Address = 192.168.10.1/24 ## My VPN server port ## ListenPort = 51194 ## VPN server's private key i.e. /etc/wireguard/privatekey ## PrivateKey = eEvqkSJVw/7cGUEcJXmeHiNFDLBGOz8GpScshecvNHU ## Save and update this config file when a new peer (vpn client) added ## SaveConfig = true |
Save and close the file when using vim text editor.
Step 5 – Set up UFW firewall rules
I am assuming that you have UFW configured and we are going to open UDP 51194 port using the ufw command as follows:{vivek@mum-vpn:~ }$ sudo ufw allow 51194/udp
Rule added
Rule added (v6)
See “How To Configure Firewall with UFW on Debian 10 LTS” for more info.
Step 6 – Enable and start WireGuard service
Turn the WireGuard service at boot time using the systemctl command, run:{vivek@mum-vpn:~ }$ sudo systemctl enable wg-quick@wg0
Start the service, execute:{vivek@mum-vpn:~ }$ sudo systemctl start wg-quick@wg0
Get the service status, run:{vivek@mum-vpn:~ }$ sudo systemctl status wg-quick@wg0
Verify that interface named wg0 is up and running on Debian server using the ip command:{vivek@mum-vpn:~ }$ sudo wg
{vivek@mum-vpn:~ }$ sudo ip a show wg0
Step 7 – Wireguard VPN client configuration
The procedure for installing and configuring a VPN client is the same as setting up the server. Let us install the client on an Debian Linux 10 desktop:{vivek@debian-10-vpn-client:~ }$
sudo sh -c "echo 'deb http://deb.debian.org/debian buster-backports
main contrib non-free' >
/etc/apt/sources.list.d/buster-backports.list"
{vivek@debian-10-vpn-client:~ }$ sudo apt update
Install wireguard on Linux desktop, run:{vivek@debian-10-vpn-client:~ }$ sudo apt install wireguard
Next we need create VPN client config on Debian/Debian/CentOS Linux destkop:{vivek@debian-10-vpn-client:~ }$ sudo sh -c 'umask 077; touch /etc/wireguard/wg0.conf'
{vivek@debian-10-vpn-client:~ }$ sudo -i
{root@debian-10-vpn-client:~ }# cd /etc/wireguard/
{root@debian-10-vpn-client:~ }# umask 077; wg genkey | tee privatekey | wg pubkey > publickey
{root@debian-10-vpn-client:~ }# ls -l publickey privatekey
## Note down the privatekey ##
{root@debian-10-vpn-client:~ }# cat privatekey
Edit the /etc/wireguard/wg0.conf file:{vivek@debian-10-vpn-client:~ }$ sudo nano /etc/wireguard/wg0.conf
## OR ##
{vivek@debian-10-vpn-client:~ }$ sudo vim /etc/wireguard/wg0.conf
Append the following directives:
[Interface] ## This Desktop/client's private key ## PrivateKey = uJPzgCQ6WNlAUp3s5rabE/EVt1qYh3Ym01sx6oJI0V4 ## Client ip address ## Address = 192.168.10.2/24 [Peer] ## Debian 10 server public key ## PublicKey = qdjdqh2pN3DEMDUDRob8K3bp9BZFJbT59fprBrl99zM ## set ACL ## AllowedIPs = 192.168.10.0/24 ## Your Debian 10 LTS server's public IPv4/IPv6 address and port ## Endpoint = 172.105.112.120:51194 ## Key connection alive ## PersistentKeepalive = 20 |
Enable and start VPN client/peer connection, run:{vivek@debian-10-vpn-client:~ }$ sudo systemctl enable wg-quick@wg0
{vivek@debian-10-vpn-client:~ }$ sudo systemctl start wg-quick@wg0
{vivek@debian-10-vpn-client:~ }$ sudo systemctl status wg-quick@wg0
Allow desktop client and Debian server connection over VPN (peer)
We need to configure the server-side peer-to-peer VPN option and allow a connection between the Desktop client computer and the server. Let us go back to our Debian 10 LTS server and edit the wg0.conf file to add [Peer] (client) information as follows (type commands on your server box):{vivek@mum-vpn:~ }$ sudo systemctl stop wg-quick@wg0
{vivek@mum-vpn:~ }$ sudo vi /etc/wireguard/wg0.conf
Append the following config:
[Peer] ## Desktop/client VPN public key ## PublicKey = 2H8vRWKCrddLf8vPwwTLMfZcRhOj10UBdc0j8W7yQAk= ## client VPN IP address (note the /32 subnet) ## AllowedIPs = 192.168.10.2/32 |
Save and close the file. Next start the service again, run:{vivek@mum-vpn:~ }$ sudo systemctl start wg-quick@wg0
Step 8 – Verification
That is all, folks. By now, both Debian servers and clients must be connected securely using a peer-to-peer VPN called WireGuard. Let us test the connection. Type the following ping command on your client machine/desktop system:{vivek@debian-10-vpn-client:~ }$ ping -c 4 192.168.10.1
{vivek@debian-10-vpn-client:~ }$ sudo wg
## try to ssh into server using our VPN connection ##
{vivek@debian-10-vpn-client:~ }$ ssh vivek@192.168.10.1
Conclusion
Congratulation! You just learned about setting up a WireGuard VPN server on Debian 10 LTS server and peer (client machine) on both Debian/CentOS Linux desktop.
