WireGuard: a lean VPN

In short: WireGuard is a modern, very lean VPN. It connects devices through an encrypted tunnel, is part of the Linux kernel and can be set up in a few lines.

Principle

Each device has a key pair (private and public). You exchange only the public keys and define which IP addresses belong to the tunnel. There are no user names or certificate chains.

Create keys

wg genkey | tee private.key | wg pubkey > public.key

Server /etc/wireguard/wg0.conf

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <server private key>
 
[Peer]
PublicKey = <phone public key>
AllowedIPs = 10.8.0.2/32

Client

[Interface]
Address = 10.8.0.2/32
PrivateKey = <phone private key>
 
[Peer]
PublicKey = <server public key>
Endpoint = server.example.com:51820
AllowedIPs = 0.0.0.0/0        # all traffic through the tunnel (or only 10.8.0.0/24)
PersistentKeepalive = 25

Start: sudo wg-quick up wg0, status: sudo wg.

Notes

• The server needs a reachable UDP address (open port 51820 in the Linux firewall) and, for internet access through the tunnel, forwarding (net.ipv4.ip_forward=1) and NAT.
• Never share private keys. For address basics: Subnet.

See also: Networking on Linux