Configure a Wireguard interface (wg) - Revision history

154pinkchairs: Undo revision 32094 by 154pinkchairs (talk)

2026-02-27T19:10:54Z

Undo revision 32094 by 154pinkchairs (talk)

← Older revision		Revision as of 19:10, 27 February 2026
Line 7:		Line 7:
	The most straightforward method to configure WireGuard is to use the tool <code>wg-quick</code> available in the package {{pkg\|wireguard-tools-wg-quick}}.		The most straightforward method to configure WireGuard is to use the tool <code>wg-quick</code> available in the package {{pkg\|wireguard-tools-wg-quick}}.

	Install the meta package {{pkg\|wireguard-tools}} to install the necessary WireGuard packages and {{pkg\|~~nftables~~}} as follows: {{Cmd\|# apk add wireguard-tools ~~nftables~~}}		Install the meta package {{pkg\|wireguard-tools}} to install the necessary WireGuard packages and {{pkg\|iptables}} as follows: {{Cmd\|# apk add wireguard-tools iptables}}

	== Configuration ==		== Configuration ==

154pinkchairs: /* Installation */ legacy iptables -> nftables

2026-02-27T19:07:44Z

Installation: legacy iptables -> nftables

← Older revision		Revision as of 19:07, 27 February 2026
Line 7:		Line 7:
	The most straightforward method to configure WireGuard is to use the tool <code>wg-quick</code> available in the package {{pkg\|wireguard-tools-wg-quick}}.		The most straightforward method to configure WireGuard is to use the tool <code>wg-quick</code> available in the package {{pkg\|wireguard-tools-wg-quick}}.

	Install the meta package {{pkg\|wireguard-tools}} to install the necessary WireGuard packages and {{pkg\|~~iptables~~}} as follows: {{Cmd\|# apk add wireguard-tools ~~iptables~~}}		Install the meta package {{pkg\|wireguard-tools}} to install the necessary WireGuard packages and {{pkg\|nftables}} as follows: {{Cmd\|# apk add wireguard-tools nftables}}

	== Configuration ==		== Configuration ==

John3-16: 1. Added stubs: 'Alternative Integrations into the Network Stack', 'Tools' and 'WireGuard Monitoring and Management'; 2. /* See also */ Added Prometheus/Grafana/Alerts setup link at medium.com.

2026-02-19T16:26:44Z

1. Added stubs: 'Alternative Integrations into the Network Stack', 'Tools' and 'WireGuard Monitoring and Management'; 2. See also: Added Prometheus/Grafana/Alerts setup link at medium.com.

@@ Line 109: / Line 109: @@
+  }
 == See also ==
 * [https://github.com/pirate/wireguard-docs WireGuard documentation]
 [[Category:Networking]]

Jahway603: Added chmod go= for private key

2026-02-18T20:30:27Z

Added chmod go= for private key

← Older revision		Revision as of 20:30, 18 February 2026
Line 14:		Line 14:

	Create a server private and public key: {{Cmd\|<nowiki># wg genkey \| tee server.privatekey \| wg pubkey > server.publickey</nowiki>}}		Create a server private and public key: {{Cmd\|<nowiki># wg genkey \| tee server.privatekey \| wg pubkey > server.publickey</nowiki>}}

			Remove any permissions on the file for users and groups other than the root user to ensure that only it can access the private key: {{Cmd\|<nowiki># chmod go= server.privatekey</nowiki>}}

	Then, we create a new config file {{Path\|/etc/wireguard/wg0.conf}} using these new keys as follows:{{Cat\|/etc/wireguard/wg0.conf\|<nowiki>		Then, we create a new config file {{Path\|/etc/wireguard/wg0.conf}} using these new keys as follows:{{Cat\|/etc/wireguard/wg0.conf\|<nowiki>

WhyNotHugo: Document how to prevent leaks from private networks.

2026-01-28T00:20:31Z

Document how to prevent leaks from private networks.

← Older revision		Revision as of 00:20, 28 January 2026
Line 86:		Line 86:

	You can repack the squash filesystem or put this script in the /etc/local.d/ path so it runs at boot-up.		You can repack the squash filesystem or put this script in the /etc/local.d/ path so it runs at boot-up.

			== Preventing leaks ==

			When using a private network over Wireguard, it may be desirable to prevent traffic from leaking onto other networks with the same range (e.g.: a Wi-Fi network using the same range).

			Suppose we are using the network <code>fd00:feed:c0de::</code> over Wireguard. To prevent leaks using [[nftables]], use the following <code>/etc/nftables.d/private-network.nft</code>:

			#!/usr/sbin/nft -f

			table inet filter {
			chain output {
			type filter hook output priority 0;

			# Allow traffic to fd00:feed:c0de::1 only via wg0.
			ip6 daddr fd00:feed:c0de::1 oifname "wg0" accept

			# Drop all other attempts to reach fd00:feed:c0de::1.
			ip6 daddr fd00:feed:c0de::1 drop
			}
			}


	== See also ==		== See also ==

Gratuxri: add ipv6

2025-10-03T18:31:28Z

add ipv6

← Older revision		Revision as of 18:31, 3 October 2025
Line 17:		Line 17:
	Then, we create a new config file {{Path\|/etc/wireguard/wg0.conf}} using these new keys as follows:{{Cat\|/etc/wireguard/wg0.conf\|<nowiki>		Then, we create a new config file {{Path\|/etc/wireguard/wg0.conf}} using these new keys as follows:{{Cat\|/etc/wireguard/wg0.conf\|<nowiki>
	[Interface]		[Interface]
	Address = 192.168.2.1/24		Address = 192.168.2.1/24, fddd::ffff/64
	ListenPort = 45340		ListenPort = 45340
	PrivateKey = <server private key value> # the key from the previously generated privatekey file		PrivateKey = <server private key value> # the key from the previously generated privatekey file
	PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE;iptables -A FORWARD -o %i -j ACCEPT		PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE;iptables -A FORWARD -o %i -j ACCEPT; ip6tables -A FORWARD -i %i -j ACCEPT; ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE;ip6tables -A FORWARD -o %i -j ACCEPT
	PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;iptables -D FORWARD -o %i -j ACCEPT		PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;iptables -D FORWARD -o %i -j ACCEPT; ip6tables -D FORWARD -i %i -j ACCEPT; ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;ip6tables -D FORWARD -o %i -j ACCEPT

	[Peer]		[Peer]
	PublicKey = <client public key value> # obtained from client device via wireguard connection setup process		PublicKey = <client public key value> # obtained from client device via wireguard connection setup process
	AllowedIPs = 192.168.2.2/32</nowiki>}}		AllowedIPs = 192.168.2.2/32, fddd::1/128</nowiki>}}

	The PostUp and PostDown iptable rules forward traffic from the wg0 subnet (192.168.2.1/24) to the lan subnet on interface eth0. Refer to [https://github.com/pirate/wireguard-docs#user-content-config-reference this WireGuard documentation] for information on adding peers to the config file.		The PostUp and PostDown iptable rules forward traffic from the wg0 subnet (192.168.2.1/24) to the lan subnet on interface eth0. Refer to [https://github.com/pirate/wireguard-docs#user-content-config-reference this WireGuard documentation] for information on adding peers to the config file.
Line 58:		Line 58:

	Edit the file {{Path\|/etc/sysctl.conf}} or a <code>.conf</code> file under {{Path\|/etc/sysctl.d/}} folder add the following line as follows:{{Cat\|/etc/sysctl.conf\|		Edit the file {{Path\|/etc/sysctl.conf}} or a <code>.conf</code> file under {{Path\|/etc/sysctl.d/}} folder add the following line as follows:{{Cat\|/etc/sysctl.conf\|
	net.ipv4.ip_forward {{=}} 1}}		net.ipv4.ip_forward {{=}} 1
			net.ipv6.conf.all.forwarding {{=}} 1
			net.ipv6.conf.default.forwarding {{=}} 1}}


	Add the sysctl service to run at boot:{{Cmd\|# rc-update add sysctl}}		Add the sysctl service to run at boot:{{Cmd\|# rc-update add sysctl}}

Prabuanand: fixed wikitags added see also section

2025-06-10T16:39:26Z

fixed wikitags added see also section

Show changes

Puzzle9: /* Enable IP Forwarding */

2025-06-10T12:04:39Z

Enable IP Forwarding

← Older revision		Revision as of 12:04, 10 June 2025
Line 83:		Line 83:

	Then either reboot or run <code>sysctl -p /etc/sysctl.conf</code> to reload the settings. To ensure forwarding is turned on, run <code>sysctl -a \| grep ip_forward</code> and ensure <code>net.ipv4.ip_forward</code> is set to <code>1</code>.		Then either reboot or run <code>sysctl -p /etc/sysctl.conf</code> to reload the settings. To ensure forwarding is turned on, run <code>sysctl -a \| grep ip_forward</code> and ensure <code>net.ipv4.ip_forward</code> is set to <code>1</code>.

			Change <code>/etc/conf.d/iptables</code> <code>IPFORWARD</code> to <code>yes</code>

	== Running with modloop ==		== Running with modloop ==

CalmGoldenTurtle: Updated instructions to reflect current release packages (3.20).

2024-06-28T03:33:14Z

Updated instructions to reflect current release packages (3.20).

← Older revision		Revision as of 03:33, 28 June 2024
Line 11:		Line 11:
	apk add wireguard-tools-wg-quick		apk add wireguard-tools-wg-quick
	apk add iptables		apk add iptables
	~~apk add sysctl~~

	== Create Server Keys and Interface Config ==		== Create Server Keys and Interface Config ==
Line 55:		Line 54:
	== As OpenRC service ==		== As OpenRC service ==

	Since Alpine 3.20, there is a OpenRC initd service file ~~included~~. To use the WireGuard OpenRC script, you need to create a symbolic link to it with the configuration name, like this:		Since Alpine 3.20, there is wireguard-tools-openrc, which provides an OpenRC initd service file. First install the package:

			<pre>
			apk add wireguard-tools-openrc
			</pre>

			To use the WireGuard OpenRC script, you then need to create a symbolic link to it with the configuration name, like this:

	<pre>		<pre>
	ln -s /etc/init.d/wg-quick /etc/init.d/wg-quick.wg0		ln -s /etc/init.d/wg-quick /etc/init.d/wg-quick.wg0
	# ~~And then call your~~ service ~~like this~~:		# Add it to the default runlevel:
			rc-update add wg-quick.wg0
			# Finally, start the service:
	rc-service wg-quick.wg0 start		rc-service wg-quick.wg0 start
	</pre>		</pre>

Fossdd: mention -openrc subpackage

2024-05-15T14:45:08Z

mention -openrc subpackage

@@ Line 51: / Line 51: @@
 iface wg0 inet static
 pre-up wg-quick up /etc/wireguard/wg0.conf
 </pre>

← Older revision		Revision as of 20:30, 18 February 2026
Line 14:		Line 14:

	Create a server private and public key: {{Cmd\|<nowiki># wg genkey \| tee server.privatekey \| wg pubkey > server.publickey</nowiki>}}		Create a server private and public key: {{Cmd\|<nowiki># wg genkey \| tee server.privatekey \| wg pubkey > server.publickey</nowiki>}}

			Remove any permissions on the file for users and groups other than the root user to ensure that only it can access the private key: {{Cmd\|<nowiki># chmod go= server.privatekey</nowiki>}}

	Then, we create a new config file {{Path\|/etc/wireguard/wg0.conf}} using these new keys as follows:{{Cat\|/etc/wireguard/wg0.conf\|<nowiki>		Then, we create a new config file {{Path\|/etc/wireguard/wg0.conf}} using these new keys as follows:{{Cat\|/etc/wireguard/wg0.conf\|<nowiki>