WireGuard Setup

Code

Step 1 — generate keys on each device·bash

# On the server
wg genkey | tee server-private.key | wg pubkey > server-public.key

# On the client (laptop)
wg genkey | tee client-private.key | wg pubkey > client-public.key

# Each side keeps its private key secret, shares only the public key
cat server-public.key
cat client-public.key

Step 2 — server config /etc/wireguard/wg0.conf·ini

[Interface]
PrivateKey = <server-private-key>
Address = 10.0.0.1/24
ListenPort = 51820
# If you want to NAT client traffic out the server's main interface (full-tunnel VPN):
PostUp   = iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE

[Peer]
PublicKey = <client-public-key>
AllowedIPs = 10.0.0.2/32

Step 3 — client config /etc/wireguard/wg0.conf·ini

[Interface]
PrivateKey = <client-private-key>
Address = 10.0.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = <server-public-key>
Endpoint = your-server.example.com:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Step 4 — bring it up and verify·bash

# On both sides
sudo wg-quick up wg0

# Status
sudo wg show

# Stop
sudo wg-quick down wg0

# Auto-start on boot (Linux)
sudo systemctl enable wg-quick@wg0

# Test the tunnel — from client, ping the server's tunnel IP
ping 10.0.0.1

# Verify your public IP changed (full-tunnel mode)
curl -s ifconfig.me   # should show server's public IP, not your local one

External links

Exercise

If you have a publicly reachable Linux server (DO droplet, home server with port forward), follow the four steps to set up a working server+client pair. Verify with ping 10.0.0.1 from the client. If you don't have such a server, skip ahead — Tailscale (next lessons) covers the same use case without needing one.

Comments 0

🔔 Reply notifications (sign in)

Sign in — Please sign in to comment.

No comments yet — be the first.