Configuring WireGuard Peers on Ubuntu Server for Two Win11 Clients

To configure WireGuard peers on an Ubuntu server for two Windows 11 clients with IPs 10.10.0.1 and 10.10.0.2, you must generate distinct key pairs for each endpoint and ensure the server configuration allows traffic forwarding between them. The server acts as a router, requiring specific kernel parameters to be enabled so that packets arriving from one client are correctly routed to the other through the virtual tunnel interface.

Prerequisites and Server Preparation

Before generating keys or editing configuration files, ensure your Ubuntu server has the necessary packages installed. You will need wireguard-tools for key generation and configuration management, and iptables or nftables for packet filtering if strict security is required. For most basic setups, enabling IP forwarding at the kernel level is the critical first step. Run the following command to check if IP forwarding is currently enabled:

sysctl net.ipv4.ip_forward

If the output is net.ipv4.ip_forward = 0, you must enable it temporarily by running sudo sysctl -w net.ipv4.ip_forward=1. To make this change persistent across reboots, edit the file /etc/sysctl.conf and add or modify the line net.ipv4.ip_forward=1. After saving the file, apply the changes using sudo sysctl -p. This step is vital because without IP forwarding, the server will drop any packets that are not destined for its own IP address, preventing client-to-client communication.

Generating Cryptographic Keys

WireGuard relies on asymmetric cryptography. You need to generate a private and public key pair for the server and each of the two Windows 11 clients. Generate these keys on the machine where they will reside to ensure security. On the Ubuntu server, execute:

wg genkey | tee server_private.key | wg pubkey > server_public.key

Repeat this process for Client 1 (Win11) and Client 2 (Win11). Store the private keys securely; never share them. The public keys will be used in the configuration files of the respective endpoints.

Configuring the Ubuntu Server

Create a new configuration file for WireGuard on the server, typically located at /etc/wireguard/wg0.conf. The configuration defines the listening port, private key, and allowed IPs for each peer. Crucially, you must allow traffic from both clients.

[Interface]
Address = 10.10.0.3/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY

[Peer]
# Client 1
PublicKey = CLIENT1_PUBLIC_KEY
AllowedIPs = 10.10.0.1/32

[Peer]
# Client 2
PublicKey = CLIENT2_PUBLIC_KEY
AllowedIPs = 10.10.0.2/32

Replace SERVER_PRIVATE_KEY, CLIENT1_PUBLIC_KEY, and CLIENT2_PUBLIC_KEY with the actual generated keys. Note that AllowedIPs specifies which IP addresses belong to each peer. By setting them to /32, we restrict traffic to only those specific host IPs, enhancing security. However, if you intend for clients to route internet traffic through the server, you would use 0.0.0.0/0 instead, though this guide focuses on local peer connectivity. After saving the file, start and enable the service:

sudo systemctl enable --now wg-quick@wg0

Verify the status with wg show to ensure the interface is up and peers are recognized.

Configuring Windows 11 Clients

On each Windows 11 machine, install the official WireGuard application. Create a new tunnel and paste the corresponding configuration. For Client 1, the config should look like this:

[Interface]
PrivateKey = CLIENT1_PRIVATE_KEY
Address = 10.10.0.1/24

[Peer]
PublicKey = SERVER_PUBLIC_KEY
AllowedIPs = 10.10.0.2/32, 10.10.0.3/32
Endpoint = SERVER_PUBLIC_IP:51820
PersistentKeepalive = 25

For Client 2, swap the addresses and keys accordingly. The AllowedIPs field here tells the client which destinations to send through the VPN tunnel. Including both the server (10.10.0.3) and the other client (10.10.0.2 for Client 1) ensures that ping requests reach their target. Set the Endpoint to your server's public IP address.

Testing Connectivity and Troubleshooting

Once all configurations are active, test the connectivity. From Client 1, open a command prompt and run ping 10.10.0.2. If successful, Client 2 can also ping Client 1. Similarly, both clients should be able to ping the server at 10.10.0.3. If pings fail, check the following:

• Firewall Rules: Ensure UDP port 51820 is open on the server’s firewall. On Ubuntu, use sudo ufw allow 51820/udp.
• IP Forwarding: Confirm net.ipv4.ip_forward is set to 1 on the server.
• MTU Settings: Windows clients sometimes require an MTU adjustment. Try setting the MTU to 1420 in the Windows WireGuard adapter settings if large packets are dropped.

For deeper insights into client-to-client issues, refer to our guide on Troubleshooting WireGuard Client-to-Client Communication Issues. Additionally, if you need to manage routing more complexly, consider reading about How to Make a Server Not Use VPN as a Default Gateway to avoid routing loops.

Frequently Asked Questions

Why can't my Windows clients ping each other?

The most common reason is that IP forwarding is disabled on the Ubuntu server. Without it, the server drops inter-client packets. Ensure net.ipv4.ip_forward=1 is set in /etc/sysctl.conf.

Do I need to open port 51820 on the server firewall?

Yes, the server must accept incoming UDP traffic on port 51820 for the initial handshake and ongoing communication. Use UFW or iptables to allow this port from trusted sources.

Can I use the same key pair for both clients?

No, each peer must have a unique key pair. Using the same keys will cause conflicts and prevent proper authentication and encryption between the server and individual clients.

What happens if I set AllowedIPs to 0.0.0.0/0?

This routes all internet traffic from the client through the server. While useful for privacy, it requires additional configuration on the server to handle NAT and masquerading, which is beyond simple peer-to-peer ping tests.

How do I verify the WireGuard connection is active?

Run wg show on the server or check the WireGuard app status on Windows. Active connections will show recent data transfer bytes under the "Latest Handshake" section.