Install WireGuard VPN server on CentOS 7, and client on Linux and Windows
WireGuard is a free alternative to OpenVPN with great encryption, speed, and simplicity. The lightweight, secure, and cross-platform VPN relies on advanced cryptography technologies in addition to supporting Windows, Linux, MacOS, BSD, Android, and iOS operating systems.
WireGuard installation is quite easy, and you only need to follow a few steps. Once installed, you can establish a connection by first exchanging the matching keys between the server and the client. This means that only a client machine with a public key corresponding to the server’s key will connect. Unlike the client-server models, the WireGuard is a peer to peer VPN. The operation depends on the configuration, and this determines if the peer will operate like the traditional server or client.
Contents
How to install and configure the WireGuard server on CentOS 7
How to set up WireGuard client on:
- CentOS 7
- Windows
- Ubuntu 18.04
- Debian 9
How to install WireGuard server on CentOS 7
Prerequisites
- CentOS 7 running on a Cloud Server
- An account with sudo privileges
- If you prefer to use root, sudo commands will still work. Alternatively, simply leave out the sudo prefix when you copy and paste all commands.
Step 1. Update the system and install WireGuard
sudo yum update
Set up the EPEL repository
This step will install the WireGuard-tools package from the EPEL repository. This provides the wg binaries that control the WireGuard server.
sudo yum install epel-release https://www.elrepo.org/elrepo-release-7.el7.elrepo.noarch.rpm
Enter Y when prompted and proceed
sudo yum install yum-plugin-elrepo
Once complete, we will now install the WireGuard VPN on CentOS 7 cloud system.
sudo yum install kmod-wireguard wireguard-tools
Type y at the two prompts to install the packages
A successful installation will return the following output
Step 2. Configure VPN server on CentOS 7
We will now generate the key pairs for the server and client.
Create a directory for the WireGuard on the server.
sudo mkdir -p /etc/wireguard/
The system will save the public and private key pair in this directory. To generate the keys, run the command below on the server.
sudo wg genkey | sudo tee /etc/wireguard/server_private.key | wg pubkey | sudo tee /etc/wireguard/server_public.key
This will return an output such as below and display the public key.
Step 3. Configure the WireGuard server interface on CentOS 7
We will now create the configuration file for the interface (wg0) which will be routing the VPN traffic. In this step, you will specify the IP subnet for the VPN network. For this article, we will use 10.10.0.1/24. When choosing the subnet, ensure that it is different from the office or home network to avoid conflicts.
First, find the name of your server’s public NIC using the command
sudo ip a
You will get an output similar to below. Look for the NIC that contains your public IP. In this case below, it is ens3
Now, we will use nano editor. To automatically create the configuration file, open it as a blank file in the editor by running
sudo nano /etc/wireguard/wg0.conf
Add the configuration text below to the new file and insert the server_private.key (PrivateKey) you generated earlier in the PrivateKey field your server private key here as shown below.
Note: replace all instances of ens3 with your own public NIC you found above.
[Interface] PrivateKey = your server private key here Address = 10.10.0.1/24 Address = fd86:ea04:1111::1/64 ListenPort = 51820 PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -A POSTROUTING -o ens3 -j MASQUERADE PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE; ip6tables -D FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -D POSTROUTING -o ens3 -j MASQUERADE SaveConfig = true
It should look as such with your real values added.
Press ctrl+O to Save and ctrl+X to Exit.
Enable user rights with this command below, so that only allowed users can read the file
sudo chmod 600 /etc/wireguard/{server_public.key,wg0.conf}
Configure firewall rules
Use the following command by inserting the port 51820 specified above
sudo firewall-cmd --permanent --add-port=51820/udp --zone=public
alternative command
sudo iptables -I INPUT 1 -p udp --dport 51820 -j ACCEPT
Verify settings
sudo iptables -L
For NAT to work, we will enable forwarding for both IP4 and IP6 in the file /etc/sysctl.conf file as below.
Use a text editor to open the file configuration file and enable the following commands.
net.ipv4.ip_forward=1
and
net.ipv6.conf.all.forwarding=1
By default, the lines are disabled; to enable them, launch the editor as below, navigate to each line, and remove the # sign at the beginning of the command.
sudo nano /etc/sysctl.conf
Save and exit.
We are now ready to bring up the wg0 interface. To do this, use the wg-quick command as follows
sudo wg-quick up wg0
Output
You can now use the wg command to see active interfaces and connected peers.
sudo wg
Since we have not configured the client, the output should be as shown below.
This shows that we have successfully configured our server interface.
Lastly, to enable the WireGuard on system boot, run the command below on both the server and the client.
sudo systemctl enable wg-quick@wg0
Set up WireGuard VPN client on CentOS 7
For most operating systems, the installation process for the WireGuard is the same for both the server and client. The only difference is the configuration file. In this article, we will learn how to configure a client in CentOS 7, Windows, Ubuntu 18.04 and Debian 9.
We will start by installing the WireGuard, after which we will generate the key pair for the client and finally do the configuration.
Step 1. Install the WireGuard using the commands below.
sudo yum update
sudo yum install epel-release https://www.elrepo.org/elrepo-release-7.el7.elrepo.noarch.rpm
sudo yum install yum-plugin-elrepo
sudo yum install kmod-wireguard wireguard-tool
Step 2. Generate keys for the client
Create the WireGuard directory.
sudo mkdir -p /etc/wireguard/
If running as a sudo user you may not have access to the WireGuard directory
Use the command to grant access to the logged-in user.
sudo chmod go+rx /etc/wireguard/
To generate key pair, run
sudo wg genkey | sudo tee /etc/wireguard/client_private.key | wg pubkey | sudo tee /etc/wireguard/client_public.key
This will generate the keys and save them in the WireGuard directory. You can use the cat command to view the keys.
Step 3. Configure client interface on CentOS 7
In this step, we will create the configuration file /etc/wireguard/wg0.conf on the client device. Please note that the file name and location are similar to that in the server and the only difference is the contents.
You will need to replace the text fields with your own PrivateKey, PublicKey, and Endpoint values.
You can obtain your client PrivateKey by running the cat command from the client’s WireGuard directory.
sudo cat client_private.key
PublicKey is the public key on the VPN server. Obtain it by using the cat command on the server.
sudo cat server_public.key
Now, open a new blank configuration file with the command below
sudo nano /etc/wireguard/wg0.conf
Insert the text below and replace the PrivateKey, PublicKey, and Endpoint fields with your real values.
[Interface] Address = 10.10.0.2/32 Address = fd86:ea04:1111::2/128 SaveConfig = true PrivateKey = your client private key here DNS = 1.1.1.1 [Peer] PublicKey = your server public key here Endpoint = your server public ip:51820 AllowedIPs = 0.0.0.0/0, ::/0
Below is our configuration file in the editor.
Save the file and exit.
Set the right permissions for your configuration file wg0.conf hence make it secure.
chmod 600 /etc/wireguard/wg0.conf
Step 4. Add the peer to the VPN server
We will now add the client public key to the server using the following syntax.
sudo wg set wg0 peer client public key allowed-ips 10.10.0.2/32,fd86:ea04:1111::2/128
To do this, go to the server and run the command below with your own client public key inserted. It will look like this.
sudo wg set wg0 peer pYEKlKZY3qqliTyl3I0HqNSPV/XD7zYQVELFIB+mYA4= allowed-ips 10.10.0.2/32,fd86:ea04:1111::2/128
To confirm the addition, run the following command on the server.
sudo wg
This shows that we have successfully added the peer.
Check connections
We will now start the interface on the client using the wg-quick command.
sudo wg-quick up wg0
This will give the following output;
When both server and client interfaces are up, you can check the status using the wg command.
On the server
sudo wg
On the client
sudo wg
This shows that we have successfully added the peer to the server and established a connection. Note that you can turn the interfaces on and off by
sudo wg-quick up wg0
to enable and
sudo wg-quick down wg0
to disable.
To enable the WireGuard on system boot, run the command below on both the server and the client.
sudo systemctl enable wg-quick@wg0
How to set up WireGuard client in Windows
Step 1. Install WireGuard
Download the WireGuard installer for Windows and install it on your Windows computer. Once complete, it will give you the following output.
Step 2. Add empty tunnel
Give it a name.
Add the configuration text below with your own values in PublicKey and Endpoint fields.
[Interface] PrivateKey = your client private key will already be here Address = 10.10.0.2/32 Address = fd86:ea04:1111::2/128 SaveConfig = true DNS = 1.1.1.1 [Peer] PublicKey = your server public key here Endpoint = your server public ip:51820 AllowedIPs = 0.0.0.0/0, ::/0
PublicKey is the public key on the VPN CentOS server. Obtain it by running the cat command on the server.
sudo cat /etc/wireguard/server_public.key
Then return to the client window and insert the value in the PublicKey field.
Click Save
Step 3. Add the client peer to the server
Now, you need to add the client public key and IP address to the server.
Run the command below, replace client public key below with your client public key generated in the tunnel window above.
sudo wg set wg0 peer client public key allowed-ips 10.10.0.2
Step 4. Return to the client machine
Click Activate on the windows machine.
If successful, the client becomes Active and you will start seeing received and sent traffic.
How to set up WireGuard client on Ubuntu 18.04
Step 1. Install WireGuard client on Ubuntu 18.04
sudo add-apt-repository ppa:wireguard/wireguard
sudo apt install wireguard
Restart client computer and confirm that it is working
sudo modprobe wireguard
lsmod | grep wireguard
If successful, it will give the output below.
Step 2. Generate key pair for Ubuntu client
This follows the same process as that of the server.
sudo chmod go+rx /etc/wireguard
cd /etc/wireguard
Run the following to generate the VPN client keys;
umask 077
sudo wg genkey | sudo tee client_private.key | wg pubkey | sudo tee client_public.key
Now that we have the key, we will go to the next step and configure the client.
Step 3. Configure WireGuard VPN client interface on Ubuntu 18.04
The process is similar to that of the server apart from the information in the configuration files. We will call our interface wg0 and use the configuration file to define the private network, our client public key, and the server’s public key and IP address.
You will need to add your real values to the PrivateKey, PublicKey, and Endpoint fields in the text below.
The client’s PrivateKey can be obtained by running the cat command from the client’s WireGuard directory.
sudo cat client_private.key
PublicKey is the key on the VPN server. Go to the server and obtain the key by running the cat command;
sudo cat server_public.key
Once you have all the details, you can now create the client configuration file.
sudo nano /etc/wireguard/wg0.conf
The command will open a blank file; insert the text below with your correct values.
[Interface] Address = 10.10.0.2/32 Address = fd86:ea04:1111::2/128 SaveConfig = true PrivateKey = your client private key here DNS = 1.1.1.1 [Peer] PublicKey = your server public key here Endpoint = your server public ip:51820 AllowedIPs = 0.0.0.0/0, ::/0
Below is our configuration file in the editor.
Save the file and exit.
Set the right permissions for your configuration file wg0.conf, hence making it secure.
sudo chmod 600 /etc/wireguard/wg0.conf
Step 4. Add the peer (client) to the VPN server
We will now add the client public key to the server using the following syntax.
sudo wg set wg0 peer client public key allowed-ips 10.10.0.2/32,fd86:ea04:1111::2/128
To do this, go to the server and run the command below with your own client public key inserted. It will look like this.
sudo wg set wg0 peer E6AoavHk75/IwG7RVFegOkV4JIdje0U8kJnbkySqsiI= allowed-ips 10.10.0.2/32,fd86:ea04:1111::2/128
To confirm the addition, run the following command on the server.
sudo wg
This shows that we have successfully added the peer.
Check connections
We will now start the interface on the client using the wg-quick command.
sudo wg-quick up wg0
If you get an error about missing resolvconf, install it using the command below, and then try to start the interface again.
sudo apt install resolvconf
This will give the following output;
You can check the status of the interface using the wg command
sudo wg
Similarly, you can go to the server and check its status.
sudo wg
To see if the client can ping the server run;
ping 10.10.0.1
This shows that we have successfully added the peer to the server and established a connection. Note that you can turn the interfaces on and off by
sudo wg-quick up wg0
to enable and
sudo wg-quick down wg0
to disable.
To enable the WireGuard on system boot, run the command below on both the server and the client.
sudo systemctl enable wg-quick@wg0
How to Install WireGuard client on Debian 9
Make sure you have sudo privileges and that it is installed with the following commands
su
apt-get install sudo -y
If you prefer to use root, sudo commands will still work. Alternatively, simply leave out the sudo prefix when you copy and paste all commands.
Step 1. Install WireGuard
echo "deb http://deb.debian.org/debian/ unstable main" > /etc/apt/sources.list.d/unstable-wireguard.list
printf 'Package: *\nPin: release a=unstable\nPin-Priority: 150\n' > /etc/apt/preferences.d/limit-unstable
apt update
apt install wireguard-dkms wireguard-tools
If successful, you will see the following output.
Enable the WireGuard kernel module and check the status
sudo modprobe wireguard && lsmod | grep wireguard
Step 2. Generate keys for the client on Debian 9
We will now generate a private and public key, which we will add to the configuration files.
sudo wg genkey | tee /etc/wireguard/client_private.key | wg pubkey > /etc/wireguard/client_public.key
Step 3. Configure WireGuard VPN client interface on Debian 9
The process is similar to that of the server apart from the information in the configuration files. We will call our interface wg0 and use the configuration file to define the private network, our client private key, and the server’s public key and IP address.
You will need to add your real values to the PrivateKey, PublicKey, and Endpoint fields in the text below.
The client’s PrivateKey can be obtained by running the cat command from the client’s WireGuard directory.
sudo cat client_private.key
PublicKey is the key on the VPN server. Go to the server and obtain the key by running the cat command;
sudo cat server_public.key
Once you have all the details, you can now create the client configuration file.
sudo nano /etc/wireguard/wg0.conf
The command will open a blank file; insert the text below with your correct values.
[Interface] Address = 10.10.0.2/32 Address = fd86:ea04:1111::2/128 SaveConfig = true PrivateKey = your client private key here DNS = 1.1.1.1 [Peer] PublicKey = your server public key here Endpoint = your server public ip:51820 AllowedIPs = 0.0.0.0/0, ::/0
Below is our configuration file in the editor.
Save the file and exit.
Set the right permissions for your configuration file wg0.conf, hence making it secure.
sudo chmod 600 /etc/wireguard/wg0.conf
Step 4. Add the peer (client) to the VPN server on Debian 9
We will now add the client public key to the server using the following syntax.
sudo wg set wg0 peer client public key allowed-ips 10.10.0.2/32,fd86:ea04:1111::2/128
To do this, go to the server and run the command below with your own client public key inserted. It will look like this.
sudo wg set wg0 peer E6AoavHk75/IwG7RVFegOkV4JIdje0U8kJnbkySqsiI= allowed-ips 10.10.0.2/32,fd86:ea04:1111::2/128
To confirm the addition, run the following command on the server.
sudo wg
This shows that we have successfully added the peer.
Check connections
We will now start the interface on the client using the wg-quick command.
sudo wg-quick up wg0
If you get an error about missing resolvconf, install it using the command below, and then try to start the interface again.
sudo apt install resolvconf
This will give the following output;
You can check the status of the interface using the wg command
sudo wg
Similarly, you can go to the server and check its status.
sudo wg
To see if the client can ping the server run;
ping 10.10.0.1
This shows that we have successfully added the peer to the server and established a connection. Note, that you can turn the interfaces on and off by running:
sudo wg-quick up wg0
to enable, and
sudo wg-quick down wg0
to disable.
To enable the WireGuard on system boot, run the command below on both the server and the client.
sudo systemctl enable wg-quick@wg0
Visit our other blogs if you’d like to learn
How to install WireGuard VPN server on Ubuntu 18.04, and client on Linux and Windows.
How to Install WireGuard VPN Server on Debian 9, and client on Linux and Windows.
Happy hosting!
