WireGuard

Deploy WireGuard, a modern virtual private network (VPN) protocol designed for creating encrypted point-to-point tunnels over the internet.

The WireGuard Quick Deploy App provides two separate applications:

• WireGuard Server. Creates a Linode and sets up a WireGuard network device named wg0. This device acts as the central hub for your WireGuard network.
• WireGuard Client. Creates a Linode that can connect to your WireGuard server. You can deploy multiple clients to connect to the same server.

Note: You can deploy the WireGuard Server and Client apps independently. If you already have the server app running, you can deploy the client app and configure it to connect to your existing server.

1. Deploy WireGuard

 Estimated deployment time: 2–5 minutes

Software included

Software installed on your Linode when deploying the app.

Base distribution and plan

• Supported distribution: Ubuntu 24.04 LTS
• Recommended plans: All plan types and sizes can be used. Select a plan appropriate for your expected VPN traffic and number of users.

Configuration options

WireGuard Server options

StackScript ID: 401706

WireGuard Client options

StackScript ID: 1914317

Use API, CLI, or Terraform

WireGuard Server

curl --location 'https://api.linode.com/v4/linode/instances' \
  --header 'Content-Type: application/json' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer abc123def456hij789klm' \
  --data-raw '{
    "region": "us-east",
    "type": "g6-standard-2",
    "image": "linode/ubuntu24.04",
    "label": "my-wireguard-server-one-click-app",
    "root_pass": "@C0mpl3x#P@ssw0rd",
    "stackscript_id": 401706,
    "stackscript_data": {
      "user_name": "jsmith"
    }
  }'

linode-cli linodes create \
  --region us-east \
  --type g6-standard-2 \
  --label my-wireguard-server-one-click-app \
  --image linode/ubuntu24.04 \
  --root_pass @C0mpl3x#P@ssw0rd \
  --stackscript_id 401706 \
  --stackscript_data '{"user_name":"jsmith"}'

resource "linode_instance" "my-linode" {
  region         = "us-east"
  type           = "g6-standard-2"
  label          = "my-wireguard-server-one-click-app"
  image          = "linode/ubuntu24.04"
  root_pass      = "@C0mpl3x#P@ssw0rd"
  stackscript_id = 401706
  stackscript_data = {
    "user_name" = "jsmith"
  }
}

WireGuard Client

curl --location 'https://api.linode.com/v4/linode/instances' \
  --header 'Content-Type: application/json' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer abc123def456hij789klm' \
  --data-raw '{
    "region": "us-east",
    "type": "g6-standard-2",
    "image": "linode/ubuntu24.04",
    "label": "my-wireguard-client-one-click-app",
    "root_pass": "@C0mpl3x#P@ssw0rd",
    "stackscript_id": 1914317,
    "stackscript_data": {
      "user_name": "jsmith",
      "wireguard_server_public_key": "1+ab23cd45e67FGh890iJklM+123nOpQrs45t6=",
      "wireguard_server_endpoint": "123.1.123.0:51820"
    }
  }'

linode-cli linodes create \
  --region us-east \
  --type g6-standard-2 \
  --label my-wireguard-client-one-click-app \
  --image linode/ubuntu24.04 \
  --root_pass @C0mpl3x#P@ssw0rd \
  --stackscript_id 1914317 \
  --stackscript_data '{"user_name":"jsmith", "wireguard_server_public_key":"1+ab23cd45e67FGh890iJklM+123nOpQrs45t6=", "wireguard_server_endpoint":"123.1.123.0:51820"}'

resource "linode_instance" "my-linode" {
  region         = "us-east"
  type           = "g6-standard-2"
  label          = "my-wireguard-client-one-click-app"
  image          = "linode/ubuntu24.04"
  root_pass      = "@C0mpl3x#P@ssw0rd"
  stackscript_id = 1914317
  stackscript_data = {
    "user_name"                   = "jsmith"
    "wireguard_server_public_key" = "1+ab23cd45e67FGh890iJklM+123nOpQrs45t6="
    "wireguard_server_endpoint"   = "123.1.123.0:51820"
  }
}

2. Configure WireGuard

Server-side configuration

The WireGuard Server deployment creates these files on the instance:

• /etc/wireguard/server_private.key. The server’s private key.
• /etc/wireguard/server_public.key. The server’s public key.
• /etc/wireguard/wg0.conf. The server’s WireGuard configuration file.

The initial wg0.conf looks like this:

[Interface]
PrivateKey = <server-private-key>
Address = <server-tunnel-address>
ListenPort = <listen-port>

Client-side configuration

The WireGuard Client deployment creates these files on the instance:

• /etc/wireguard/client_private.key. The client’s private key.
• /etc/wireguard/client_public.key. The client’s public key.
• /etc/wireguard/wg0.conf. The client’s WireGuard configuration file.

The initial wg0.conf looks like this:

[Interface]
PrivateKey = <client-private-key>
Address = <client-tunnel-ip>
MTU = 1420
DNS = 8.8.8.8

Add clients to a server

To add a new client to your WireGuard server:

1. Deploy a new WireGuard Client instance and copy its public key.

   Bash

   cat /etc/wireguard/client_public.key

2. On the WireGuard Server instance, edit its /etc/wireguard/wg0.conf file.

   Bash

   sudo nano /etc/wireguard/wg0.conf

3. Add a [Peer] section with the client public key and allowed client tunnel IP.

   Bash

   [Peer]
   PublicKey = <client-public-key>
   AllowedIPs = <client-tunnel-ip>

4. Restart the WireGuard Service on the server.

   Bash

   sudo systemctl restart wg-quick@wg0
   sudo wg-quick down wg0
   sudo wg-quick up wg0

Test the connection

To test the connection between your WireGuard Client and Server:

1. From the client instance, ping the server’s tunnel IP.

   Bash

   ping <server-tunnel-ip>

2. Check the WireGuard connection status.

   The output displays the WireGuard interface and peer status. Verify that the peer is listed and that the latest handshake shows a recent time indicating that the client is connected and communicating with the server. The transfer values show the amount of data exchanged through the VPN tunnel.

   CommandOutput

   sudo wg show

    interface: wg0
      public key: <server-public-key>
      private key: (hidden)
      listening port: 51820
   
    peer: <client-public-key>
      endpoint: <client-ip>:<port>
      allowed ips: <client-tunnel-ip>
      latest handshake: 1 minute, 17 seconds ago
      transfer: 98.86 KiB received, 43.08 KiB sent

Additional resources

For more information about the installed packages, see their official documentation.

• WireGuard Quick Start
• WireGuard Conceptual Overview
• WireGuard Man Page