How To Install Wireguard on Debian 10

In this tutorial, we will show you how to install Wireguard on Debian 10. For those of you who didn’t know, WireGuard is an open-source, free, modern, and fast VPN server with state-of-the-art cryptography. It is quicker and simpler as compared to IPSec and OpenVPN. It is cross-platform and can run almost anywhere, including Linux, Windows, Android, and macOS.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you through the step-by-step installation of the Wireguard VPN on a Debian 10 (Buster).

Prerequisites

• A server running one of the following operating systems: Debian 10.
• It’s recommended that you use a fresh OS install to prevent any potential issues
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Install Wireguard on Debian 10 Buster

Step 1. Before running the tutorial below, it’s important to make sure your system is up to date by running the following apt commands in the terminal:

sudo apt update

Step 2. Installing Wireguard on Debian 10.

WireGuard is available from the Debian backports repositories. Now we add the repository to your Debian system:

echo 'deb http://ftp.debian.org/debian buster-backports main' | sudo tee /etc/apt/sources.list.d/buster-backports.list

Once done, update the apt cache and install the WireGuard using the following command:

sudo apt update
sudo apt install wireguard

Step 3. Configure WireGuard VPN.

Now we run the following command to generate the key pair:

wg genkey | sudo tee /etc/wireguard/privatekey | wg pubkey | sudo tee /etc/wireguard/publickey

Next, create a new file named wg0.conf with the following contents:

sudo nano /etc/wireguard/wg0.conf

Add the following lines:

[Interface]
Address = 10.0.0.1/24
SaveConfig = true
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE

Save and set the file’s permissions:

sudo chmod 600 /etc/wireguard/{privatekey,wg0.conf}

Once done, start WireGuard and enable it at boot:

sudo wg-quick up wg0
sudo systemctl enable wg-quick@wg0

Step 4. Configure Firewall.

I am assuming that you have UFW configured and we are going to open UDP 51820 port using the ufw command as follows:

sudo apt install ufw

Next, add the following rules to allow SSH and WireGuard connections:

sudo ufw allow ssh
sudo ufw allow 51820/udp

Congratulations! You have successfully installed Wireguard. Thanks for using this tutorial for installing the latest version of Wireguard VPN on the Debian system. For additional help or useful information, we recommend you check the official Wireguard website.