How to Install Wireguard VPN on Rocky Linux 9

Introduction

WireGuard is a modern, open-source and high-performance VPN (Virtual Private Network) solution known for its simplicity and efficiency. It aims offers secure and fast connections between different using tunnels to enable remote access, site-to-site connections, or protect outgoing network traffic. WireGuard offers improved speed, reliability, and ease of use as compared to traditional VPN protocols such as OpenVPN and IPSec.

This article explains how to install WireGuard VPN on Rocky Linux 9 to enable secure network tunnel connections on the server.

Prerequisites

Before you begin:

• Deploy two Vultr Rocky Linux 9 servers to use as the VPN server and client.
• Disable the SELinux.
• Access the server using SSH as a non-root user with sudo privileges.
• Update the server.

Install WireGuard

WireGuard is not available in the default repositories on Rocky Linux 9. Follow the steps below to enable the EPEL (Extra Packages for Enterprise Linux) repository and install WireGuard on your server.

1. Install the EPEL repository.

   CONSOLE

   Copy

   $ sudo dnf install epel-release -y

   Explain Code

   Powered by Vultr AgentBeta

2. Install the WireGuard tools package.

   CONSOLE

   Copy

   $ sudo dnf install wireguard-tools -y

   Explain Code

   Powered by Vultr AgentBeta

3. View the installed WireGuard version on your server.

   CONSOLE

   Copy

   $ sudo wg --version

   Explain Code

   Powered by Vultr AgentBeta

   Your output should be similar to the one below.

   wireguard-tools v1.0.20210914 - https://git.zx2c4.com/wireguard-tools/

Configure WireGuard

WireGuard uses the cryptokey routing mechanism to create VPN tunnels on your server by checking public keys linked to specific IP addresses. WireGuard requires a private key that matches a valid public key to enable VPN tunnel connections on a network interface. Follow these steps to set up a new WireGuard interface and create key pairs to use on your server.

1. Generate a new WireGuard server private and public key pair in the /etc/wireguard directory.

   CONSOLE

   Copy

   $ wg genkey | sudo tee /etc/wireguard/server_private.key | wg pubkey | sudo tee /etc/wireguard/server_public.key

   Explain Code

   Powered by Vultr AgentBeta

2. Modify the file permissions to grant only privileged users read access to the generated keys.

   CONSOLE

   Copy

   $ sudo chmod 600 /etc/wireguard/server_private.key /etc/wireguard/server_public.key

   Explain Code

   Powered by Vultr AgentBeta

3. View your available server network interfaces and verify your main interface details.

   CONSOLE

   Copy

   $ ip a

   Explain Code

   Powered by Vultr AgentBeta

   Your output should be similar to the one below.

   1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
       link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
       inet 127.0.0.1/8 scope host lo
          valid_lft forever preferred_lft forever
       inet6 ::1/128 scope host 
          valid_lft forever preferred_lft forever
   2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
       link/ether 38:7a:0e:10:5a:ae brd ff:ff:ff:ff:ff:ff
       inet 192.0.2.161/24 brd 172.20.10.15 scope global dynamic noprefixroute wlp0s20f3
          valid_lft 85088sec preferred_lft 85088sec
       inet6 2409:40c1:14:6eab:ce6f:8e79:efc5:60c/64 scope global temporary dynamic 
          valid_lft 603489sec preferred_lft 84553sec
       inet6 2409:40c1:14:6eab:ef9d:ccec:abeb:e230/64 scope global mngtmpaddr noprefixroute 
          valid_lft forever preferred_lft forever

   Based on the above output. enp1s0 is the main public network interface name and uses the public IP address 192.0.2.161 required by WireGuard to translate and forward network requests to the Internet.

4. Create a new WireGuard server interface configuration file. For example, wg0.conf.

   CONSOLE

   Copy

   $ sudo nano /etc/wireguard/wg0.conf

   Explain Code

   Powered by Vultr AgentBeta

5. Add the following configurations to the file. Replace <Server_Private_Key> with the actual private key you generated earlier.

   INI

   Copy

   [Interface]
   Address = 172.16.0.1/24
   SaveConfig = true
   PrivateKey = <Server_Private_Key>
   ListenPort = 51820

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

   The above WireGuard configuration creates a new interface with the private IP address 172.16.0.1. Within the configuration:

   • Address = 172.16.0.1/24: Assigns the private IP address 172.16.0.1 to the WireGuard interface, with a subnet mask of 255.255.255.0.
   • SaveConfig = true: Enables WireGuard to automatically save the configuration when the server shuts down.
   • PrivateKey = <Server_Private_Key>: Sets the WireGuard server's private key.
   • ListenPort = 51820: Sets the WireGuard server port 51820 to listen for incoming VPN connection requests.

Generate WireGuard Client Configurations

A WireGuard client configuration consists of a private and public key pair allowed to create connections through the WireGuard server tunnel interface. In the following steps, create a new WireGuard client configuration that includes new private and public keys, permitted addresses, and traffic to allow on the VPN tunnel connections.

1. Generate new private and public keys in the WireGuard directory /etc/wireguard/. Replace client with your desired client naming scheme.

   CONSOLE

   Copy

   $ wg genkey | sudo tee /etc/wireguard/client_private.key | wg pubkey | sudo tee /etc/wireguard/client_public.key

   Explain Code

   Powered by Vultr AgentBeta

2. View the generated WireGuard client private and public key values.

   CONSOLE

   Copy

   $ sudo cat /etc/wireguard/client_private.key /etc/wireguard/client_public.key 

   Explain Code

   Powered by Vultr AgentBeta

   Copy the generated private and public key values to your clipboard.

3. Create a new WireGuard client configuration file.

   CONSOLE

   Copy

   $ sudo nano /etc/wireguard/client.conf

   Explain Code

   Powered by Vultr AgentBeta

4. Add the following configurations to the file. Replace <Client_Private_Key> with your generated private key, <Server_Public_Key>, 192.0.2.161 with your actual WireGuard server's public key and IP address respectively.

   INI

   Copy

   [Interface]
   PrivateKey = <Client_Private_Key>
   Address = 172.16.0.2/24
   DNS = 8.8.8.8
   
   [Peer]
   PublicKey = <Server_Public_Key>
   AllowedIPs = 0.0.0.0/0
   Endpoint = 192.0.2.161:51820
   PersistentKeepalive = 15

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

   The above configuration assigns creates a new WireGuard client with the private VPN tunnel IP address 172.16.0.2. Within the configuration:

   • PrivateKey: Sets the WireGuard client's private key used for encryption and authentication in the VPN tunnel.
   • Address: Sets the WireGuard client's private IP address 172.16.0.2 with a subnet mask of 255.255.255.0.
   • DNS: Sets Google public DNS server 8.8.8.8 as the DNS resolver to resolve domain names when connected to the VPN tunnel.
   • PublicKey: Sets the public key of the destination WireGuard server.
   • AllowedIPs: Defines the network client network addresses allowed to connect through the VPN tunnel.
   • Endpoint: Sets the WireGuard server public IP address 192.0.2.161 and port 51820 to use when connecting to the VPN tunnel.
   • PersistentKeepalive: Keeps the VPN connection active by sending keep-alive packets every 15 seconds.

5. Open the WireGuard server interface configuration to enable the new client configuration.

   CONSOLE

   Copy

   $ sudo nano /etc/wireguard/wg0.conf

   Explain Code

   Powered by Vultr AgentBeta

6. Add the following configurations at the end of the file. Replace <Client_Public_Key> with your actual WireGuard client's public key you generated earlier.

   INI

   Copy

   [Peer]
   PublicKey = <Client_Public_Key>
   AllowedIPs = 172.16.0.2/32

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

Manage WireGuard VPN Processes

The WireGuard wg-quick utility starts and manages VPN processes on your server. Follow the steps below to enable your WireGuard interface to start at boot time and allow VPN tunnels on your server using the wg-quick utility.

1. Start the WireGuard server wg0 interface.

   CONSOLE

   Copy

   $ sudo systemctl start wg-quick@wg0.service

   Explain Code

   Powered by Vultr AgentBeta

2. Enable the WireGuard wg0 interface to automatically start at boot time.

   CONSOLE

   Copy

   $ sudo systemctl enable wg-quick@wg0.service

   Explain Code

   Powered by Vultr AgentBeta

3. View the WireGuard interface status and verify that it's active on your server.

   CONSOLE

   Copy

   $ sudo systemctl status wg-quick@wg0.service

   Explain Code

   Powered by Vultr AgentBeta

   Output.

   ● wg-quick@wg0.service - WireGuard via wg-quick(8) for wg0
   Loaded: loaded (/usr/lib/systemd/system/wg-quick@.service; disabled; preset: disabled)
   Active: active (exited) since Thu 2024-06-20 04:43:08 UTC; 7s ago
     Docs: man:wg-quick(8)
      man:wg(8)
      https://www.wireguard.com/
      https://www.wireguard.com/quickstart/
      https://git.zx2c4.com/wireguard-tools/about/src/man/wg-quick.8
      https://git.zx2c4.com/wireguard-tools/about/src/man/wg.8
   Process: 1593 ExecStart=/usr/bin/wg-quick up wg0 (code=exited, status=0/SUCCESS)
      Main PID: 1593 (code=exited, status=0/SUCCESS)
      CPU: 27ms
   
   Jun 20 04:43:08 server systemd[1]: Starting WireGuard via wg-quick(8) for wg0...
   Jun 20 04:43:08 server wg-quick[1593]: [#] ip link add wg0 type wireguard
   Jun 20 04:43:08 server wg-quick[1593]: [#] wg setconf wg0 /dev/fd/63
   Jun 20 04:43:08 server wg-quick[1593]: [#] ip -4 address add 172.16.0.1/24 dev wg0
   Jun 20 04:43:08 server wg-quick[1593]: [#] ip link set mtu 1420 up dev wg0
   Jun 20 04:43:08 server systemd[1]: Finished WireGuard via wg-quick(8) for wg0.

4. View the WireGuard interface logs to verify the tunnel processes.

   CONSOLE

   Copy

   $ sudo journalctl -u wg-quick@wg0.service

   Explain Code

   Powered by Vultr AgentBeta

Set Up Firewall Rules

FirewallD is available and active on Vultr Rocky Linux 9 servers by default. In the following steps, configure the firewall to allow network connections on the default WireGuard server port 51820. In addition, enable port forwarding to forward network requests from the WireGuard interface to the internet using Network Address Translation (NAT) on your server.

1. View the firewalld status and verify that it's active.

   CONSOLE

   Copy

   $ sudo systemctl status firewalld

   Explain Code

   Powered by Vultr AgentBeta

   If the firewalldstatus is inactive, run the following command to allow the SSH port 22 and enable the firewall.

   CONSOLE

   Copy

   $ sudo firewall-cmd --permanent --add-port=22/tcp && sudo firewall-cmd --reload

   Explain Code

   Powered by Vultr AgentBeta

2. Allow the default WireGuard interface UDP port 51820 through the firewall.

   CONSOLE

   Copy

   $ sudo firewall-cmd --permanent --add-port=51820/udp

   Explain Code

   Powered by Vultr AgentBeta

3. Reload firewalldto apply your configuration changes.

   CONSOLE

   Copy

   $ sudo firewall-cmd --reload

   Explain Code

   Powered by Vultr AgentBeta

4. View all available firewalldport rules on your server and verify that the WireGuard port is available.

   CONSOLE

   Copy

   $ sudo firewall-cmd --list-ports

   Explain Code

   Powered by Vultr AgentBeta

   Output.

   51820/udp
   22/tcp

5. Enable IPV4 forwarding to forward packets from the WireGuard network to the server's public interface.

   CONSOLE

   Copy

   $ echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.conf

   Explain Code

   Powered by Vultr AgentBeta

6. Reload your sysctl configuration to apply the configuration changes.

   CONSOLE

   Copy

   $ sudo sysctl -p

   Explain Code

   Powered by Vultr AgentBeta

7. Enable address translation of network requests from the WireGuard interface 172.16.0.0/24 subnet to allow client connections to the Internet.

   CONSOLE

   Copy

   $ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="172.16.0.0/24" masquerade'

   Explain Code

   Powered by Vultr AgentBeta

8. Reload firewalldto apply the new configuration changes.

   CONSOLE

   Copy

   $ sudo firewall-cmd --reload

   Explain Code

   Powered by Vultr AgentBeta

Connect VPN Clients to the WireGuard VPN Server

Each WireGuard client requires a valid configuration file with a public key allowed to connect to the WireGuard VPN server interface. In the following steps, connect VPN clients to your WireGuard VPN server using the configuration you created earlier and test the VPN tunnel connections using the Ping utility.

1. Access your Rocky Linux 9 client server using SSH.

   CONSOLE

   Copy

   $ ssh exampleuser@SERVER-IP

   Explain Code

   Powered by Vultr AgentBeta

2. Install the EPEL repository and the WireGuard tools package on your server.

   CONSOLE

   Copy

   $ sudo dnf install epel-release -y && sudo dnf install wireguard-tools -y

   Explain Code

   Powered by Vultr AgentBeta

3. Download your WireGuard client configuration file from the VPN server using a file transfer protocol such as scp.

   CONSOLE

   Copy

   $ sudo scp root@wireguard-server-ip:/etc/wireguard/client.conf /etc/wireguard/wg0.conf

   Explain Code

   Powered by Vultr AgentBeta

4. Enable the systemd-resolved service to enable DNS resolutions on the WireGuard network.

   CONSOLE

   Copy

   $ sudo systemctl enable systemd-resolved && sudo systemctl start systemd-resolved 

   Explain Code

   Powered by Vultr AgentBeta

5. Enable the WireGuard client interface wg0 to connect to the VPN tunnel.

   CONSOLE

   Copy

   $ sudo wg-quick up wg0

   Explain Code

   Powered by Vultr AgentBeta

   Output:

   [#] ip link add wg0 type wireguard
   [#] wg setconf wg0 /dev/fd/63
   [#] ip -4 address add 172.16.0.2/24 dev wg0
   [#] ip link set mtu 1420 up dev wg0
   [#] resolvconf -a wg0 -m 0 -x

6. View the WireGuard tunnel status to verify that a VPN connection is established.

   CONSOLE

   Copy

   $ sudo wg

   Explain Code

   Powered by Vultr AgentBeta

   Your output should be similar to the one below.

   interface: wg0
     public key: 5HIoIGQlOWBiFJ0GjDLcoYsnsJOXfEKTPrHkOuDlzBQ=
     private key: (hidden)
     listening port: 48387
   
   peer: l91LF+SGHAep7KzVrVkz4REH5WQORceqXP1QxLR5Hyw=
     endpoint: 192.0.2.161:51820
     allowed ips: 172.16.0.0/24
     latest handshake: 31 seconds ago
     transfer: 92 B received, 244 B sent
     persistent keepalive: every 15 seconds

7. Test connectivity to the WireGuard VPN server private IP address 172.16.0.1 using the Ping utility.

   CONSOLE

   Copy

   $ ping -c 5 172.16.0.1

   Explain Code

   Powered by Vultr AgentBeta

   Verify that the connection is successful similar to the following output:

   PING 17.16.0.1 (17.16.0.1) 56(84) bytes of data.
   64 bytes from 17.16.0.1: icmp_seq=1 ttl=64 time=0.056 ms
   64 bytes from 17.16.0.1: icmp_seq=2 ttl=64 time=0.076 ms
   64 bytes from 17.16.0.1: icmp_seq=3 ttl=64 time=0.064 ms
   64 bytes from 17.16.0.1: icmp_seq=4 ttl=64 time=0.065 ms
   64 bytes from 17.16.0.1: icmp_seq=4 ttl=64 time=0.068 ms
   
   --- 17.16.0.1 ping statistics ---
   4 packets transmitted, 4 received, 0% packet loss, time 3049ms
   rtt min/avg/max/mdev = 0.056/0.065/0.076/0.007 ms

Conclusion

You have installed WireGuard on your Rocky Linux 9 server and connected clients to a VPN tunnel. WireGuard supports multiple client connections using valid key pairs allowed in your configurations. In addition, you can set up different interfaces and enable multiple client connections on the server. For more information, visit the WireGuard documentation.