WireGuard VPN Complete Setup Guide: Fast, Secure Networking for Linux Servers

Step 4: Connect Client

#!/bin/bash
# Connect client to server

# Copy configuration to /etc/wireguard
sudo cp ~/wireguard-clients/client1.conf /etc/wireguard/

# Bring up client interface
sudo wg-quick up /etc/wireguard/client1.conf

# Verify connection
sudo wg show

# Test connectivity
ping 10.0.0.1

# Check which traffic routes through VPN
curl icanhazip.com  # Should show VPN server IP

# Enable on boot
sudo systemctl enable wg-quick@client1

Advanced Networking Scenarios

Site-to-Site VPN

#!/bin/bash
# Configure site-to-site VPN connection

# Site A configuration
cat > /etc/wireguard/wg-siteA.conf <
Address = 10.0.1.1/24
ListenPort = 51820

[Peer]
PublicKey = 
AllowedIPs = 10.0.2.0/24
Endpoint = siteB.example.com:51820
PersistentKeepalive = 25
EOF

# Site B configuration
cat > /etc/wireguard/wg-siteB.conf <
Address = 10.0.2.1/24
ListenPort = 51820

[Peer]
PublicKey = 
AllowedIPs = 10.0.1.0/24
Endpoint = siteA.example.com:51820
PersistentKeepalive = 25
EOF

# Bring up both sides
sudo wg-quick up wg-siteA
sudo wg-quick up wg-siteB

# Configure routing to remote site networks
sudo ip route add 10.0.2.0/24 via 10.0.2.1 dev wg-siteB

Multi-Hop VPN Chain

#!/bin/bash
# Create multi-hop VPN (client -> server1 -> server2)

# Server 1 (gateway)
cat > /etc/wireguard/wg0-gateway.conf <
Address = 10.0.1.1/24
ListenPort = 51820

[Peer]
PublicKey = 
AllowedIPs = 10.0.2.0/24
Endpoint = server2.example.com:51820
PersistentKeepalive = 25
EOF

# Server 2 (final destination)
cat > /etc/wireguard/wg0-destination.conf <
Address = 10.0.2.1/24
ListenPort = 51821

[Peer]
PublicKey = 
AllowedIPs = 10.0.1.0/24
Endpoint = server1.example.com:51820
PersistentKeepalive = 25
EOF

# Client configuration (routes through both)
cat > ~/wireguard-clients/multi-hop.conf <
Address = 10.0.1.2/32

[Peer]
PublicKey = 
AllowedIPs = 10.0.0.0/16
Endpoint = server1.example.com:51820
PersistentKeepalive = 25
EOF

Load Balancing

#!/bin/bash
# Load balance clients across multiple servers

# Configure each server with same private key but different port
# Server 1
sudo wg-quick up wg0
sudo ip link set wg0 mtu 1340

# Server 2
sudo wg-quick up wg1
sudo ip link set wg1 mtu 1340

# DNS round-robin for load balancing
# vpn.example.com -> 203.0.113.1, 203.0.113.2

# Client automatically selects endpoint
CLIENT_CONFIG=~/.config/wireguard/client.conf
# Endpoint = vpn.example.com:51820

Security Hardening

Firewall Configuration

#!/bin/bash
# Harden WireGuard with firewall rules

# Allow only WireGuard traffic
sudo ufw allow 51820/udp
sudo ufw deny in on eth0 to 10.0.0.0/24
sudo ufw allow in on wg0

# Prevent leaks
sudo ufw enable
sudo ufw status verbose

# Configure nftables for advanced rules
sudo nft add table inet wireguard
sudo nft add chain inet wireguard input
sudo nft add chain inet wireguard output
sudo nft add rule inet wireguard input udp dport 51820 accept
sudo nft add rule inet wireguard input ip saddr 10.0.0.0/24 accept

Encryption and Key Management

#!/bin/bash
# Best practices for key management

# Generate keys with high entropy
wg genkey | tee privatekey | wg pubkey > publickey

# Store private keys securely
sudo chmod 600 /etc/wireguard/privatekey

# Encrypt sensitive configuration
sudo openssl enc -aes-256-cbc -salt -in privatekey -out privatekey.enc

# Key rotation script
#!/bin/bash
OLD_KEY=$(wg showconf wg0 | grep PrivateKey | awk '{print $3}')
NEW_KEY=$(wg genkey)

# Update server config
sed -i "s/PrivateKey = $OLD_KEY/PrivateKey = $NEW_KEY/" /etc/wireguard/wg0.conf

# Restart interface
sudo wg-quick down wg0
sudo wg-quick up wg0

# Notify clients of key change

DDoS Mitigation

#!/bin/bash
# Configure WireGuard DDoS protection

# Rate limiting
sudo wg set wg0 private-key <(wg genkey)

# Per-peer rate limiting
sudo tc qdisc add dev wg0 root tbf rate 100mbit burst 32kbit latency 400ms

# Drop malformed packets
sudo nft add rule inet wireguard input ip version != 4 drop
sudo nft add rule inet wireguard input icmp type != echo-request drop

# Monitor for attacks
sudo journalctl -u wg-quick -f | grep -i error

Performance Optimization

Throughput Optimization

#!/bin/bash
# Optimize WireGuard throughput

# Increase MTU size
sudo ip link set wg0 mtu 1500

# Buffer sizes
sudo sysctl -w net.core.rmem_max=134217728
sudo sysctl -w net.core.wmem_max=134217728
sudo sysctl -w net.ipv4.tcp_rmem="4096 87380 67108864"
sudo sysctl -w net.ipv4.tcp_wmem="4096 65536 67108864"

# Enable jumbo frames
sudo ethtool -K eth0 gso on
sudo ethtool -K eth0 tso on

# Test throughput
iperf3 -s  # Server
iperf3 -c 10.0.0.2  # Client

Latency Optimization

#!/bin/bash
# Minimize latency

# Adjust PersistentKeepalive in peer config
# Lower values = less latency but more overhead
# Recommended: 10-25 seconds

# Disable Nagle's algorithm
echo 1 | sudo tee /proc/sys/net/ipv4/tcp_nodelay

# Reduce CPU overhead with offloading
sudo ethtool -K eth0 gro on
sudo ethtool -K eth0 gso on

# Monitor latency
ping -c 100 10.0.0.2 | tail -1

Connection Monitoring

#!/bin/bash
# Monitor WireGuard connection health

# Real-time monitoring script
watch -n 1 'sudo wg show'

# Check per-peer statistics
sudo wg show wg0 dump | awk '{
  print "Peer: " $2
  print "Latest Handshake: " $3
  print "Received: " $4 " bytes"
  print "Sent: " $5 " bytes"
}'

# Alert on stale connections
STALE_TIME=300
while true; do
  HANDSHAKE=$(date -d "$(sudo wg show wg0 latest-handshakes | cut -f2)" +%s)
  CURRENT=$(date +%s)
  AGE=$((CURRENT - HANDSHAKE))
  
  if [ $AGE -gt $STALE_TIME ]; then
    echo "Alert: Stale connection detected"
    sudo wg-quick down wg0
    sudo wg-quick up wg0
  fi
  sleep 60
done

Troubleshooting Guide

Connection Issues

#!/bin/bash
# Diagnose connection problems

# 1. Verify keys match
echo "Server public key:"
sudo cat /etc/wireguard/publickey
echo "Client sees:"
wg show client0

# 2. Check firewall
sudo ufw show added
sudo iptables -L -n

# 3. Verify port is open
sudo ss -tlnp | grep 51820
telnet server.example.com 51820

# 4. Check interface status
sudo ip link show wg0
sudo wg show wg0

# 5. Test routing
traceroute 10.0.0.1
route -n

Performance Issues

#!/bin/bash
# Debug performance problems

# 1. Check interface errors
ethtool -S wg0

# 2. Monitor packet loss
ping -c 100 10.0.0.2 | grep "% packet loss"

# 3. Measure throughput
iperf3 -c 10.0.0.1 -t 30 -R

# 4. Check CPU load
top -p $(pgrep wg-quick)

# 5. Verify MTU configuration
ip link show wg0 | grep mtu

Logging and Diagnostics

#!/bin/bash
# Enable detailed logging

# Check kernel logs
sudo dmesg | grep wireguard

# View systemd logs
sudo journalctl -u wg-quick@wg0 -f

# Enable verbose mode
sudo wg set wg0 private-key <(wg genkey) listen-port 51820

# Packet capture
sudo tcpdump -i wg0 -n -w wireguard-traffic.pcap

# Analyze captured traffic
sudo wireshark wireguard-traffic.pcap

Conclusion: WireGuard as Your VPN Foundation

WireGuard represents the modern approach to VPN technology. Its simplicity, performance, and security make it the ideal choice for site-to-site connectivity, client-to-site VPN, and private networks.

Key takeaways:
- Install WireGuard from official repositories
- Generate secure key pairs for all endpoints
- Configure server with IP forwarding enabled
- Add clients systematically with proper routing
- Monitor connections for optimal performance
- Implement security hardening measures

Whether deploying WireGuard for enterprise site-to-site networking, personal privacy, or private network infrastructure, following these guidelines ensures a secure, performant, and maintainable VPN solution.