WIREGUARD
MASTERY

What is WireGuard?

WireGuard is a modern VPN protocol designed for simplicity and performance. It's cross-platform, open source, and uses state-of-the-art cryptography.

Why WireGuard?

• Fast: 3-4x faster than OpenVPN
• Simple: ~4,000 lines of code
• Secure: Modern cryptography (Curve25519, ChaCha20)
• Cross-platform: Linux, Windows, macOS, iOS, Android

How It Works

WireGuard creates a simple tunnel interface. Each peer has a public/private key pair. Peers authenticate using these keys—no certificates needed.

Quiz

Installing WireGuard

Linux

# Ubuntu/Debian
sudo apt install wireguard

# Fedora
sudo dnf install wireguard-tools

# Arch
sudo pacman -S wireguard-tools

macOS

# Using Homebrew
brew install wireguard-tools

# Or from App Store: WireGuard

Windows

Download from wireguard.com/install

Quiz

Server Configuration

Generate Keys

# /etc/wireguard/wg0.conf
[Interface]
PrivateKey = SERVER_PRIVATE_KEY
Address = 10.0.0.1/24
ListenPort = 51820
SaveConfig = true

# Enable forwarding
PostUp = iptables -A FORWARD -i %i -j ACCEPT
PostUp = iptables -A FORWARD -o %i -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Allow existing connections
PostDown = iptables -D FORWARD -i %i -j ACCEPT
PostDown = iptables -D FORWARD -o %i -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Start WireGuard

# Enable and start
sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

# Check status
sudo wg show

Quiz

Client Setup

Generate Client Keys

wg genkey
# Output: CLIENT_PRIVATE_KEY

echo "CLIENT_PRIVATE_KEY" | wg pubkey
# Output: CLIENT_PUBLIC_KEY

Client Config

# /etc/wireguard/wg0.conf (client)
[Interface]
PrivateKey = CLIENT_PRIVATE_KEY
Address = 10.0.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = server.example.com:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Add Peer to Server

sudo wg set wg0 peer CLIENT_PUBLIC_KEY allowed-ips 10.0.0.2/32

Quiz

Key Management

Generating Keys

# Generate private key
wg genkey

# Generate private key and save
wg genkey > private.key

# Generate public key from private
cat private.key | wg pubkey > public.key

# One-liner
wg genkey | tee private.key | wg pubkey > public.key

Pre-Shared Key (Optional)

For extra security between peers:

wg genpsk

Security

• Keep private keys secret
• Public keys can be shared
• Use unique keys per peer

Quiz

Mobile Setup

iOS

1. Install WireGuard from App Store
2. Create new tunnel
3. Import config or generate keys

Android

1. Install WireGuard from Play Store or F-Droid
2. Create tunnel
3. Scan QR code or import config

QR Code Config

# Generate QR code
qrencode -t ansi < client.conf

On-Demand VPN

Configure to auto-connect on WiFi/cellular.

Quiz

Securing WireGuard

Basic Firewall Rules

# Allow WireGuard port
sudo ufw allow 51820/udp

# Forward traffic
sudo ufw default FORWARD ACCEPT

# Or more secure - only allow specific IPs
sudo ufw allow from 10.0.0.0/24

ufw config

# /etc/ufw/sysctl.conf
net/ipv4/ip_forward=1
net/ipv6/conf/all/forwarding=1

nftables

# /etc/nftables.conf
# Add to inet filter forward chain
iif wg0 oif eth0 accept
iif eth0 oif wg0 accept

Quiz

Selective Routing

Full Tunnel vs Split Tunnel

• Full: All traffic through VPN
• Split: Only specific traffic through VPN

Split Tunnel Config

# Only route specific network through VPN
[Peer]
AllowedIPs = 10.0.0.0/24, 192.168.1.0/24

# Route specific host
AllowedIPs = 192.168.1.100/32

Use Cases

• Access home network
• Company network access
• Streaming (specific region)

Quiz

Server with Multiple Clients

Adding Peers

# Add peer
sudo wg set wg0 peer CLIENT_PUBLIC_KEY allowed-ips 10.0.0.3/32

# Add multiple peers
sudo wg set wg0 peer PEER1_PUBKEY allowed-ips 10.0.0.2/32
sudo wg set wg0 peer PEER2_PUBKEY allowed-ips 10.0.0.3/32
sudo wg set wg0 peer PEER3_PUBKEY allowed-ips 10.0.0.4/32

Config File Method

# /etc/wireguard/wg0.conf
[Interface]
PrivateKey = SERVER_PRIVATE_KEY
Address = 10.0.0.1/24
ListenPort = 51820

[Peer]
PublicKey = CLIENT1_PUBLIC
AllowedIPs = 10.0.0.2/32

[Peer]
PublicKey = CLIENT2_PUBLIC
AllowedIPs = 10.0.0.3/32

[Peer]
PublicKey = CLIENT3_PUBLIC
AllowedIPs = 10.0.0.4/32

Quiz

Peer-to-Peer WireGuard

Mesh Network

In a mesh, each peer connects directly to others—no central server.

Example: 3-Peer Mesh

# Peer A config
[Interface]
PrivateKey = A_PRIVATE
Address = 10.0.0.1/24

[Peer]
PublicKey = B_PUBLIC
Endpoint = B.example.com:51820
AllowedIPs = 10.0.0.2/32

[Peer]
PublicKey = C_PUBLIC
Endpoint = C.example.com:51820
AllowedIPs = 10.0.0.3/32

Tools

• Netmaker: Managed mesh
• WireGuard Easy: Simple UI
• Headscale: Control server

Quiz

Optimization

MTU Settings

# Reduce MTU for better performance
[Interface]
MTU = 1420

PersistentKeepalive

# Add to peer config
PersistentKeepalive = 25

Performance Tips

• Use WireGuard kernel module (Linux 5.6+)
• Reduce MTU on slow connections
• Enable packet steering

Quiz

Debugging

Check Status

# Show interface
sudo wg show

# Show interface with more detail
sudo wg show wg0

Common Issues

• No connection: Check firewall, keys, endpoint
• Slow: Check MTU, network
• DNS not working: Check DNS setting
• Can't access internet: Check forwarding

Test Connectivity

# Ping through VPN
ping 10.0.0.1

# Check port
nc -zvu server.example.com 51820

# View logs
sudo journalctl -u wg-quick@wg0 -f

Congratulations!

You've completed the WireGuard Mastery guide. You now understand:

• WireGuard fundamentals
• Installation on all platforms
• Server configuration
• Client setup
• Key generation
• Mobile clients
• Firewall rules
• Split tunneling
• Multiple peers
• Mesh networks
• Performance tuning
• Troubleshooting