Learn WireGuard - Installation & Initial Setup

#Introduction

The theory is enough. Episode 3 gets you installing WireGuard on real machines, then creating your first working configuration. After this episode, both of your VMs will each have an active wg0 interface and a private key ready to connect to a peer.

We will install on Debian/Ubuntu as the main path, mention distribution alternatives, cover cross-platform paths such as WireGuard-Go and WireGuardNT, and close with a full verification using wg show.

#Installing on Linux

#Debian and Ubuntu with Kernel 5.6 or Later

Because the wireguard module is already built into kernel 5.6 and later, you only need to install the tools package:

sudo apt update
sudo apt install wireguard
wg --version

The wireguard package pulls in wireguard-tools, which contains wg and wg-quick. Make sure wg --version runs without errors.

#Older Kernels and Other Alternatives

For kernels below 5.6, install wireguard-dkms so the module is compiled automatically from source:

sudo apt install wireguard-dkms

Fedora uses sudo dnf install wireguard-tools, and Arch uses sudo pacman -S wireguard-tools. On systems where modprobe wireguard succeeds, you are ready. You can follow the first configuration below directly.

#First Configuration

#Generating a Key Pair

WireGuard does not use passwords. Each interface needs a private key that guards its identity. Generate the private key and derive its public key:

wg genkey | tee /etc/wireguard/privatekey | wg pubkey > /etc/wireguard/publickey
chmod 600 /etc/wireguard/privatekey
cat /etc/wireguard/privatekey
cat /etc/wireguard/publickey

The privatekey output is secret and must never be shared. The public key in /etc/wireguard/publickey is what you share with other peers as your identity.

#Writing wg0.conf

Create the main configuration file /etc/wireguard/wg0.conf. In this episode we fill in the interface section first; the peer section will be added when we connect the two VMs in the next episode:

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <isi dengan isi file privatekey>
 
[Peer]
PublicKey = <kunci publik VM lain>
AllowedIPs = 10.0.0.2/32
Endpoint = 203.0.113.5:51820

Once again: PrivateKey above comes from the privatekey file, and PublicKey in the peer section is the public key of the other VM. Change the example address 203.0.113.5 to your peer server's public address.

#Bringing the Interface Up

wg-quick reads wg0.conf, creates the wg0 interface, assigns the address, and adds routes according to AllowedIPs:

sudo wg-quick up wg0

This process also stores the configuration in a systemd-friendly way. To run it automatically at boot, enable the service:

sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

#Verifying the Installation

#Reading the Interface State

After wg-quick up wg0 succeeds, verify with:

sudo wg show
ip addr show wg0
ip route show

The wg show output displays the interface, public key, listen port, and the list of peers along with the last handshake. ip addr show wg0 confirms the 10.0.0.1/24 address is assigned, and ip route show shows the route to 10.0.0.2/32 that wg-quick added automatically.

#Bringing Down and Reading Configuration

Two commands you will often use for maintenance:

sudo wg-quick down wg0
sudo wg-quick strip wg0

wg-quick strip wg0 shows the version of the configuration that wg-quick will apply (including the firewall rules injected by PostUp). This is useful for checking what actually gets executed when the interface is brought up.

#Closing

Episode 3 completed the installation and initial setup: the tools are installed on both VMs, a key pair has been generated, the first wg0.conf has been written, and the wg0 interface has been brought up and verified.

Key takeaways:

• Kernel 5.6 or later already includes the wireguard module; you only need to install wireguard-tools.
• The private key lives in privatekey; the public key is derived with wg pubkey.
• wg0.conf lives in /etc/wireguard/ and is read by wg-quick.
• wg-quick up wg0 creates the interface, address, and routes all at once.
• wg show is the main window for inspecting the state.

In episode 4 we cover interface and key management — generating a pre-shared key with wg genpsk, filling in the [Interface] and [Peer] sections completely, and adding your first peer so that your two VMs finally connect to each other.