Learn WireGuard - Pre-Requisite Skills & Environment Setup

#Introduction

Welcome to the Learn WireGuard series! This series will take you from mastering WireGuard — a modern VPN protocol built on cryptokey routing and the Noise Protocol Framework — from the foundations of the concepts all the way to production readiness. There are 23 episodes in total, arranged across six phases.

WireGuard is different from the older generation of VPNs. It is not a collection of bolted-together mechanisms; it is a protocol designed from scratch: a small codebase, modern key cryptography, and every routing decision based on public keys. To understand it in depth, you need a footing in three areas: networking, Linux administration, and basic cryptography.

Episode 0 is your roadmap. We will make sure you have the basic skills, set up two Linux VMs, install the WireGuard tools, and verify that the kernel is ready to load the wireguard module. Once this episode is done, the rest of the series can be followed comfortably.

#Required Skills

#Basic Networking

WireGuard is a layer 3 protocol. You should be comfortable with IP addressing, subnetting, and routing. Understand how to read prefixes such as /24 and /32, because AllowedIPs in episode 6 is built entirely on these concepts. You also need to understand NAT, since almost every deployment involves devices behind a home router or the cloud.

• IP routing: how packets choose their next hop through the routing table.
• NAT: the mechanism that rewrites source and destination addresses at the gateway.
• Firewall: iptables/nftables rules for opening and allowing ports.
• Port management: WireGuard runs over UDP, and UDP ports need to be forwarded.

#Linux Administration

Every practice in this series runs on Linux. You should be familiar with systemd, network interface configuration, and the basic CLI:

ip link show
ip addr show
ip route show
systemctl status ssh
journalctl -u ssh

The ip link show and ip addr show commands will become your companions throughout the series, because WireGuard creates a new virtual interface named wg0 that is registered through the kernel.

#Public Key Cryptography

WireGuard does not use usernames and passwords. The identity of a node is its public key. You should understand the difference between symmetric and asymmetric keys, what Diffie-Hellman is, and the concept of authenticated encryption:

• Asymmetric keys: the private key is kept secret, the public key is shared.
• Diffie-Hellman: two parties derive a shared secret from a combination of their respective keys.
• Authenticated encryption: data is encrypted and its authenticity verified at the same time.

Don't worry if you are not deeply familiar yet — episode 13 will dissect WireGuard's cryptography in full. For now, it is enough to understand that a public key on your system acts like an identity address on the WireGuard network.

#Software and Tools to Prepare

#Two Linux VMs

You need two Linux machines to experience a real two-way connection. They can be two VMs on your laptop, two VMs in the cloud, or one VM and your physical laptop. Make sure both can ping each other over the normal network before you start. The names we will use throughout the series: server (the first VM) and client (the second VM).

#Kernel 5.6 or Later

Since Linux 5.6, the wireguard module has been part of the kernel. Verify your kernel version and the module:

uname -r
modinfo wireguard

If modinfo wireguard returns module information, you do not need to install any extra driver. For older kernels, distributions provide wireguard-dkms, which compiles the module automatically — we cover that in episode 3.

#Installing WireGuard Tools

#Debian and Ubuntu

Install the tools with apt. For kernel 5.6 and later, the wireguard package is enough because the module is already built in:

sudo apt update
sudo apt install wireguard
wg --version

The wg --version command shows the tools version along with the kernel version. Run the same installation on both VMs. You may also prepare one VM with NixOS, Arch, or Fedora, but the examples in this series use Debian/Ubuntu.

#Supporting Tools

In addition to wg and wg-quick, also prepare qrencode (for QR codes in episode 16), iperf3 (for benchmarking in episode 15), and jq for parsing output. Install them now so you are not interrupted halfway through the series:

sudo apt install qrencode iperf3 jq

#Verifying the Environment

#Testing a Dummy Interface Boot

Before moving on to episode 1, verify that a WireGuard interface can actually be created. No full configuration is needed — just make sure the kernel creates the wg0 interface:

sudo ip link add dev wg0 type wireguard
sudo ip link show wg0
sudo ip link del dev wg0

If those three commands run without errors, your environment is ready. The wg0 interface that was briefly created is removed again by the last command.

#Skills Summary

Here is a recap of the prerequisites you have prepared in episode 0:

• Networking basics: IP routing, subnetting, NAT, and firewall.
• Linux administration: systemd, ip link, ip addr, and ip route.
• Cryptography concepts: public keys, Diffie-Hellman, and authenticated encryption.
• Two Linux VMs that can ping each other, each with kernel 5.6 or later.
• Tools installed: wg, wg-quick, qrencode, iperf3, and jq.

If anything is missing, stop and complete it before continuing. A strong foundation will make the next 22 episodes feel much lighter.

#Closing

In episode 0 you have laid the groundwork for the entire series: understanding the networking, Linux, and cryptography skills required, preparing two VMs, installing the WireGuard tools, and verifying that the kernel is ready to load the wireguard module.

Key takeaways:

• WireGuard identifies nodes by public key, not by username.
• Two Linux VMs with kernel 5.6 or later are your practice environment.
• modinfo wireguard confirms the kernel module is available.
• The main tools are wg for configuration and wg-quick for bringing the interface up.
• WireGuard interfaces are created as kernel devices named wg0.

In episode 1 we will cover the history, background, and why WireGuard — from the complexity of OpenVPN and IPsec, the birth of WireGuard by Jason A. Donenfeld in 2016, to its inclusion in the Linux kernel 5.6 in 2020. Make sure your environment is ready, because the Learn WireGuard journey is just beginning!