s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

wg

WireGuard: a fast, simple, modern VPN in the Linux kernel; wg and wg-quick set it up.

Level
DevSecOps service
Group
Network services
Needs root
Yes
Package
wireguard-tools
Also called
wireguard, wg-quick

What it does

WireGuard builds encrypted tunnels with small configs: each peer has a key pair, an interface address and a list of peers (public key, endpoint, AllowedIPs). AllowedIPs is both the routing table and the access list. It uses UDP (often port 51820), modern crypto (Curve25519, ChaCha20) and has no certificates. Use it for admin access to a lab, site-to-site links and node-to-node encryption (k3s wireguard-native, Tailscale is built on it).

On RHEL, NetworkManager also manages WireGuard (nmcli connection import type wireguard file wg0.conf).

How to write it

wg [show|showconf|set|genkey|pubkey|genpsk] ...
wg-quick up|down|strip INTERFACE

Main parts

Commands

genkey / pubkey
Make a private key / its public key.
genpsk
Pre-shared key (extra layer).
show [IF]
Peers, handshakes, traffic.
showconf IF
Print the running config.
set IF peer KEY allowed-ips …
Change a peer live.
wg-quick up IF / down IF
Start / stop from /etc/wireguard/IF.conf.
wg-quick strip IF
Config without wg-quick parts.

Options 6

Most used

Config keys

[Interface] PrivateKey / Address / ListenPort
This side.
[Peer] PublicKey
The other side.
AllowedIPs
Networks routed to and accepted from this peer.
Endpoint HOST:PORT
Where to reach the peer.
PersistentKeepalive = 25
Keep NAT open (clients behind NAT).
PresharedKey
Optional extra key.

Examples 10

$ run as a normal user# run as root (or with sudo)

  1. 1Make keys

    umask 077
wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub

  2. 2Server config

    cat /etc/wireguard/wg0.conf
[Interface]
Address = 10.99.0.1/24
ListenPort = 51820
PrivateKey = <server private key>
[Peer]
PublicKey = <laptop public key>
AllowedIPs = 10.99.0.2/32

  3. 3Laptop config

    cat wg0.conf
[Interface]
Address = 10.99.0.2/24
PrivateKey = <laptop private key>
[Peer]
PublicKey = <server public key>
Endpoint = vpn.example.com:51820
AllowedIPs = 10.99.0.0/24, 192.168.122.0/24
PersistentKeepalive = 25

  4. 4Open the port and start

    firewall-cmd --permanent --add-port=51820/udp && firewall-cmd --reload
systemctl enable --now wg-quick@wg0

  5. 5Check the tunnel

    wg show
ping -c2 10.99.0.2

  6. 6Route the lab network through the server

    sysctl -w net.ipv4.ip_forward=1
firewall-cmd --permanent --zone=trusted --add-interface=wg0 && firewall-cmd --reload

  7. 7Add a peer without restart

    wg set wg0 peer 'b3J4ZXhhbXBsZXB1YmxpY2tleW9ubHkwMDAwMDAwMDA=' allowed-ips 10.99.0.3/32
wg-quick save wg0

  8. 8Use NetworkManager on RHEL

    nmcli connection import type wireguard file /etc/wireguard/wg0.conf
nmcli connection show wg0

  9. 9Show the last handshake (is the peer alive?)

    wg show wg0 latest-handshakes

  10. 10Stop it

    wg-quick down wg0

Watch out

  • Private keys stay on their own host (chmod 600); only public keys are shared.
  • A wrong AllowedIPs (like 0.0.0.0/0 by mistake) sends all traffic through the tunnel.
  • WireGuard has no user login or MFA; for many users use a product on top (Tailscale, Netbird, Headscale).

Files

/etc/wireguard/*.conf
Interface configs (secret!).

Tips to remember

  • Give every device its own key and /32 address, so you can remove one device alone.

Exit codes

0Success.
1Error.

Full manual

This page explains the command in simple words. The original manual has every detail.

In your terminal: man 8 wg

Open the man page (linux.die.net)www.wireguard.com