In this tutorial, we will show you how to install Wireguard on Debian 10. For those of you who didn’t know, WireGuard is an open-source, free, modern, and fast VPN server with state-of-the-art cryptography. It is quicker and simpler as compared to IPSec and OpenVPN. It is cross-platform and can run almost anywhere, including Linux, Windows, Android, and macOS.
This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you through the step-by-step installation of the Wireguard VPN on a Debian 10 (Buster).
Prerequisites
- A server running one of the following operating systems: Debian 10.
- It’s recommended that you use a fresh OS install to prevent any potential issues
- A
non-root sudo useror access to theroot user. We recommend acting as anon-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.
Install Wireguard on Debian 10 Buster
Step 1. Before running the tutorial below, it’s important to make sure your system is up to date by running the following apt commands in the terminal:
sudo apt update
Step 2. Installing Wireguard on Debian 10.
WireGuard is available from the Debian backports repositories. Now we add the repository to your Debian system:
echo 'deb http://ftp.debian.org/debian buster-backports main' | sudo tee /etc/apt/sources.list.d/buster-backports.list
Once done, update the apt cache and install the WireGuard using the following command:
sudo apt update sudo apt install wireguard
Step 3. Configure WireGuard VPN.
Now we run the following command to generate the key pair:
wg genkey | sudo tee /etc/wireguard/privatekey | wg pubkey | sudo tee /etc/wireguard/publickey
Next, create a new file named wg0.conf with the following contents:
sudo nano /etc/wireguard/wg0.conf
Add the following lines:
[Interface] Address = 10.0.0.1/24 SaveConfig = true ListenPort = 51820 PrivateKey = SERVER_PRIVATE_KEY PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE
Save and set the file’s permissions:
sudo chmod 600 /etc/wireguard/{privatekey,wg0.conf}
Once done, start WireGuard and enable it at boot:
sudo wg-quick up wg0 sudo systemctl enable wg-quick@wg0
Step 4. Configure Firewall.
I am assuming that you have UFW configured and we are going to open UDP 51820 port using the ufw command as follows:
sudo apt install ufw
Next, add the following rules to allow SSH and WireGuard connections:
sudo ufw allow ssh sudo ufw allow 51820/udp
Congratulations! You have successfully installed Wireguard. Thanks for using this tutorial for installing the latest version of Wireguard VPN on the Debian system. For additional help or useful information, we recommend you check the official Wireguard website.
