Here’s a step-by-step guide to setting up WireGuard on Debian 12.
1. Install WireGuard
First, ensure your system is up to date and install the necessary packages.
Update the package list:
sudo apt update;sudo apt upgrade -y
Install WireGuard:
sudo apt install wireguard wireguard-tools
This will install WireGuard and its command-line tools.
2. Generate Keys for Server and Client
Both the server and client require a private and public key pair for secure communication.
Generate server key pair:
wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub
Generate client key pair:
If you’re configuring a client device (e.g., another server or device), you need to generate its keys too:
wg genkey | tee /etc/wireguard/client.key | wg pubkey > /etc/wireguard/client.pub
You can run this command on the machine you want to configure as the client.
3. Configure WireGuard Server
Edit the server configuration file
On the server, create or edit the WireGuard configuration file at /etc/wireguard/wg0.conf:
sudo nano /etc/wireguard/wg0.conf
Example configuration:
[Interface]
Address = 10.0.0.1/24 # The server's virtual IP address
ListenPort = 51820 # The listening port
PrivateKey = <server-private-key> # The private key generated from /etc/wireguard/server.key
[Peer]
PublicKey = <client-public-key> # The client's public key
AllowedIPs = 10.0.0.2/32 # The client's virtual IP address
PrivateKey: The server’s private key from /etc/wireguard/server.key.
PublicKey: The client’s public key, which you will insert here.
AllowedIPs: The IP address range that the client is allowed to access.
Configure the firewall
If your server has a firewall enabled, allow the necessary WireGuard port (default is 51820 UDP):
sudo ufw allow 51820/udp
Start WireGuard service
Start the WireGuard service and enable it to start on boot:
sudo systemctl start wg-quick@wg0
sudo systemctl enable wg-quick@wg0
4. Configure WireGuard Client
Edit the client configuration file
On the client device, create the configuration file /etc/wireguard/wg0.conf and add the following:
[Interface]
PrivateKey = # The private key from /etc/wireguard/client.key
Address = 10.0.0.2/24 # The client’s virtual IP address
[Peer]
PublicKey = <server-public-key> # The server's public key
Endpoint = <server-public-ip>:51820 # The server's public IP and port
AllowedIPs = 0.0.0.0/0 # Route all traffic through WireGuard
PersistentKeepalive = 25 # Keep connection alive (seconds)
PrivateKey: The client’s private key from /etc/wireguard/client.key.
PublicKey: The server’s public key from /etc/wireguard/server.pub.
Endpoint: The server’s public IP address and port.
AllowedIPs: If you want the client to route all traffic through the VPN, set it to 0.0.0.0/0.
Start the client WireGuard service:
sudo systemctl start wg-quick@wg0
sudo systemctl enable wg-quick@wg0
5. Verify the Connection
On the server, check the connection status:
sudo wg show
On the client device, test the connection:
Use ping to test connectivity to the server’s virtual IP:
ping 10.0.0.1
If everything is set up correctly, you should be able to ping the server.
6. Configure Routing and NAT (Optional)
If you want the client to access the server’s network and route traffic through the VPN, you’ll need to enable IP forwarding and set up NAT.
Enable IP forwarding:
sudo sysctl -w net.ipv4.ip_forward=1
Configure NAT:
To make IP forwarding permanent, edit the sysctl configuration file:
sudo nano /etc/sysctl.conf
Uncomment the following line:
net.ipv4.ip_forward=1
Then reload the sysctl settings:
sudo sysctl -p
Set up firewall rules for NAT:
sudo ufw allow 51820/udp
sudo ufw route allow in on wg0 out on eth0
Replace eth0 with your actual network interface.
7. Disconnect and Stop the Service
If you need to stop WireGuard, you can do so using the following command:
sudo systemctl stop wg-quick@wg0
Summary
Following these steps, you should have WireGuard successfully installed and configured on your Debian 12 system, allowing secure VPN communication between your server and client. You can further configure additional clients or tweak network settings as needed.