Install WireGuard

WireGuard ships in two halves, and which ones you need depends on your system. The kernel module is the part that moves packets; on Linux 5.6 and later it is already in the kernel, so there is nothing to install. The tools (wg and wg-quick) are the part you actually type at, and those you do install.

On platforms without a kernel implementation there is a userspace version (wireguard-go) that fills the same role more slowly.

Note

Package names below are the ones the project documents. Versions move, so if a command fails, check the official installation page before assuming the package is gone.

Linux

Most distributions carry the tools directly.

Distribution	Command
Ubuntu	sudo apt install wireguard
Debian	apt install wireguard (enable backports on releases older than Bullseye)
Fedora	sudo dnf install wireguard-tools
Arch	sudo pacman -S wireguard-tools
openSUSE / SLE	sudo zypper install wireguard-tools
Alpine	apk add -U wireguard-tools
Gentoo	emerge wireguard-tools
Mageia	sudo urpmi wireguard-tools
Slackware	sudo slackpkg install wireguard-tools
Void	xbps-install -S wireguard-tools

On kernels older than 5.6 you may also need a module package — wireguard-dkms with your kernel headers, or a distribution-specific equivalent such as Arch’s wireguard-lts. NixOS, OpenWRT, RHEL, CentOS, Oracle Linux, Termux, Buildroot, EdgeOS and several others are covered on the official page.

Windows

Download the installer from the project. It covers Windows 10 and 11, and Server 2016 through 2025. Individual MSIs are published if you need to deploy them.

macOS

There is an App Store application. For the command-line tools, Homebrew and MacPorts both carry wireguard-tools alongside the userspace wireguard-go.

Android and iOS

Official apps are published on the Play Store and the App Store. An APK is available directly for Android if you don’t use the Play Store.

BSD

FreeBSD has a kernel module (kmod) as well as the userspace implementation and the tools. OpenBSD carries the tools.

Bring up an interface

Once the tools are installed, the whole lifecycle is a handful of commands. On Linux, create the interface — this loads the module for you:

ip link add dev wg0 type wireguard

On platforms using the userspace implementation, run wireguard-go wg0 instead.

Give it an address:

ip address add dev wg0 192.168.2.1/24

You need a key pair before you can configure peers. Set a restrictive umask first, because a private key readable by other users is not a private key:

umask 077
wg genkey | tee privatekey | wg pubkey > publickey

Configure the interface with your private key and a peer’s public key. The allowed-ips value is the important one — it is the set of source addresses that peer’s key is permitted to use, and it is doing authentication as well as routing:

wg set wg0 listen-port 51820 private-key ./privatekey \
  peer <THEIR_PUBLIC_KEY> allowed-ips 192.168.2.2/32 endpoint <HOST>:51820

Bring it up:

ip link set up dev wg0

wg show prints the current state; wg showconf prints the configuration. Running wg with no arguments shows every WireGuard interface.

Let wg-quick do the dance

Typing that sequence by hand gets old. wg-quick reads a config file and does the whole bring-up and tear-down for you, which is what most people actually use day to day. Consult the wg(8) and wg-quick(8) manual pages — the wg man page is published online.

If you are behind NAT

WireGuard is quiet by design: when nobody is sending packets, it sends nothing. That is good for battery and bad for NAT, because a firewall that sees no traffic eventually forgets the mapping and inbound packets stop arriving.

If you need to receive traffic after a silent period, set a persistent keepalive. Twenty-five seconds is the interval the project recommends as working across a wide range of firewalls. It is off by default, and if you don’t need it, leave it off — it makes WireGuard chattier than it wants to be.

Next

• How it works — what cryptokey routing actually means.
• Cryptography and security — the primitives, and how to report a vulnerability.