To run Wireguard on an Ubuntu VPS using a configuration copied from macOS, you must first ensure the
wireguard-tools package is installed and then create the systemd service file. The process involves copying the
[Interface] section from your macOS config to the server's
/etc/wireguard/wg0.conf file, adjusting network settings for the Linux environment, and enabling the service with
wg-quick. This approach allows you to leverage existing client configurations while adapting them for server-side operation on Ubuntu.
Prerequisites and Installation
Before configuring the Wireguard interface, you need to install the necessary software packages on your Ubuntu VPS. Unlike macOS, which often includes Wireguard utilities in its ecosystem or via Homebrew, Ubuntu requires explicit installation of the tools that manage the virtual network interface.
Run the following commands to update your package list and install the required tools:
sudo apt update
sudo apt install wireguard-tools
This command installs
wg,
wg-quick, and related utilities. If you are using Ubuntu 22.04 or later, you may also need the kernel headers if you plan to compile additional modules, but for basic
wg-quick functionality, the standard tools are sufficient. Ensure that your system has the appropriate kernel modules loaded by checking
lsmod | grep wireguard.
Preparing the Configuration File
The core challenge when migrating a configuration from macOS to Ubuntu is the difference in how the two operating systems handle network interfaces and IP addresses. A macOS Wireguard configuration typically focuses on the client side, defining local IPs and peer endpoints. For a VPS acting as a server, you need to extract the relevant parts and adapt them.
Create a new configuration file at
/etc/wireguard/wg0.conf. You can use a text editor like
nano or
vim:
sudo nano /etc/wireguard/wg0.conf
Copy the
[Interface] section from your macOS config. However, you must make specific adjustments:
1.
Address: Change the IP address to a static IP suitable for your server subnet, such as
10.0.0.1/24.
2.
PrivateKey: If this VPS is the server, it needs its own private key. If you are simply tunneling traffic through an existing setup, ensure you have the correct private key for this interface.
3.
ListenPort: Specify the port Wireguard should listen on, typically
51820.
Example structure for the server interface:
[Interface]
Address = 10.0.0.1/24
PrivateKey =
ListenPort = 51820
If you intend to route traffic from clients to the internet or other networks, you might need to add
PostUp and
PostDown rules for iptables or nftables to enable masquerading. For example:
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
Adjust
eth0 to match your actual external network interface name, which you can find using
ip link show.
Setting Permissions and Enabling the Service
Wireguard configuration files contain sensitive private keys and must be protected. Set the correct permissions to ensure only the root user can read the file:
sudo chmod 600 /etc/wireguard/wg0.conf
Next, enable the Wireguard service to start automatically on boot and bring up the interface immediately:
sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0
Check the status of the service to verify it is running correctly:
sudo systemctl status wg-quick@wg0
If the service fails to start, check the logs for errors:
journalctl -xeu wg-quick@wg0
Common issues include incorrect syntax in the configuration file or missing kernel modules. If you encounter module-related errors, refer to our guide on
Understanding Ubuntu 22.04 VPS Security to ensure your kernel supports the necessary modules.
Testing and Troubleshooting
Once the service is active, verify the interface is up by running:
wg show
This command displays the current status of all Wireguard interfaces, including peers, handshake times, and data transferred. If you are connecting from a macOS client, ensure that the client's configuration points to the correct public IP of your Ubuntu VPS and uses the corresponding public key.
If you experience connectivity issues, check firewall rules. Ubuntu’s default firewall (UFW) might block incoming UDP traffic on port 51820. Allow the traffic with:
sudo ufw allow 51820/udp
For more complex setups involving split tunnels or multiple VPSs, consider reading about
WireGuard: Persistent Keepalive Not Working for Split Tunnel with Single Client and Two VPSs to optimize your connection stability.
Frequently Asked Questions
Why does my Wireguard interface fail to start after copying the config?
The most common cause is incorrect permissions or syntax errors in the configuration file. Ensure the file permissions are set to 600 and that there are no trailing spaces or invalid characters in the private keys. Check the system logs using journalctl for specific error messages indicating what went wrong during initialization.
Can I use the same private key for both macOS and Ubuntu?
No, each Wireguard interface must have a unique private key. While you can share the same public key infrastructure, the private key associated with the server interface on Ubuntu must be different from the client key on macOS to maintain security and proper routing. Using duplicate keys will result in conflicts and failed handshakes.
How do I allow internet access for clients connected to my Ubuntu Wireguard server?
You need to configure NAT (Network Address Translation) using iptables or nftables in the PostUp and PostDown scripts within your configuration file. This ensures that traffic from the Wireguard tunnel is masqueraded through the server’s external IP address, allowing clients to access the internet as if they were directly connected to the server’s network.
What should I do if UFW blocks my Wireguard connections?
By default, UFW may not allow incoming UDP traffic on the Wireguard port. You can resolve this by explicitly allowing the port using the command
sudo ufw allow 51820/udp. Additionally, ensure that forwarding is enabled in UFW settings if you are routing traffic between interfaces, as disabled forwarding will drop packets even if the port is open.
Is it possible to run multiple Wireguard instances on one Ubuntu VPS?
Yes, you can run multiple Wireguard instances by creating separate configuration files, such as
wg1.conf,
wg2.conf, etc., in the
/etc/wireguard/ directory. Each instance will have its own systemd service unit, like
[email protected], which can be enabled and started independently. This allows you to serve different subnets or groups of clients with distinct configurations.