Chapter 7. Setting up a WireGuard VPN
WireGuard is a high-performance VPN solution that runs in the Linux kernel. It uses modern cryptography and is easier to configure than many other VPN solutions. Additionally, WireGuard’s small codebase reduces the surface for attacks and, therefore, improves security. For authentication and encryption, WireGuard uses keys similar to SSH.
WireGuard is provided as a Technology Preview only. Technology Preview features are not supported with Red Hat production Service Level Agreements (SLAs), might not be functionally complete, and Red Hat does not recommend using them for production. These previews provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.
See Technology Preview Features Support Scope on the Red Hat Customer Portal for information about the support scope for Technology Preview features.
Note that all hosts that participate in a WireGuard VPN are peers. This documentation uses the terms client
to describe hosts that establish a connection and server
to describe the host with the fixed hostname or IP address that the clients connect to and optionally route all traffic through this server.
To set up a WireGuard VPN, you must complete the following steps:
- Configure the server.
- Open the WireGuard port in the local firewall.
- Configure the clients.
WireGuard operates on the network layer (layer 3). Therefore, you cannot use DHCP and must assign static IP addresses or IPv6 link-local addresses to the tunnel devices on both the server and clients.
You can use WireGuard only if the Federal Information Processing Standard (FIPS) mode in RHEL is disabled.
7.1. Protocols and primitives used by WireGuard
WireGuard uses the following protocols and primitives:
- ChaCha20 for symmetric encryption, authenticated with Poly1305, using Authenticated Encryption with Associated Data (AEAD) construction as described in RFC7539
- Curve25519 for Elliptic-curve Diffie–Hellman (ECDH) key exchange
- BLAKE2s for hashing and keyed hashing, as described in RFC7693
- SipHash24 for hash table keys
- HKDF for key derivation, as described in RFC5869
7.2. How WireGuard uses tunnel IP addresses, public keys, and remote endpoints
When WireGuard sends a network packet to a peer:
- WireGuard reads the destination IP from the packet and compares it to the list of allowed IP addresses in the local configuration. If the peer is not found, WireGuard drops the packet.
- If the peer is valid, WireGuard encrypts the packet using the peer’s public key.
- The sending host looks up the most recent Internet IP address of the host and sends the encrypted packet to it.
When WireGuard receives a packet:
- WireGuard decrypts the packet using the private key of the remote host.
- WireGuard reads the internal source address from the packet and looks up whether the IP is configured in the list of allowed IP addresses in the settings for the peer on the local host. If the source IP is on the allowlist, WireGuard accepts the packet. If the IP address is not on the list, WireGuard drops the packet.
The association of public keys and allowed IP addresses is called Cryptokey Routing Table
. This means that the list of IP addresses behaves similar to a routing table when sending packets, and as a kind of access control list when receiving packets.
7.3. Using a WireGuard client behind NAT and firewalls
WireGuard uses the UDP protocol and transmits data only when a peer sends packets. Stateful firewalls and network address translation (NAT) on routers track connections to enable a peer behind NAT or a firewall to receive packets.
To keep the connection active, WireGuard supports persistent keepalives
. This means you can set an interval at which WireGuard sends keepalive packets. By default, the persistent keep-alive feature is disabled to reduce network traffic. Enable this feature on the client if you use the client in a network with NAT or if a firewall closes the connection after some time of inactivity.
Note that you cannot configure keepalive packets in WireGuard connections by using the RHEL web console. To configure this feature, edit the connection profile by using the nmcli
utility.
7.4. Creating private and public keys to be used in WireGuard connections
WireGuard uses base64-encoded private and public keys to authenticate hosts to each other. Therefore, you must create the keys on each host that participates in the WireGuard VPN.
For secure connections, create different keys for each host, and ensure that you only share the public key with the remote WireGuard host. Do not use the example keys used in this documentation.
If you plan to use the RHEL web console to create a WireGuard VPN connection, you can, alternatively, generate the public and private key pairs in the web console.
Procedure
Install the
wireguard-tools
package:# dnf install wireguard-tools
Create a private key and a corresponding public key for the host:
# wg genkey | tee /etc/wireguard/$HOSTNAME.private.key | wg pubkey > /etc/wireguard/$HOSTNAME.public.key
You will need the content of the key files, but not the files themselves. However, Red Hat recommends keeping the files in case that you need to remember the keys in future.
Set secure permissions on the key files:
# chmod 600 /etc/wireguard/$HOSTNAME.private.key /etc/wireguard/$HOSTNAME.public.key
Display the private key:
# cat /etc/wireguard/$HOSTNAME.private.key YFAnE0psgIdiAF7XR4abxiwVRnlMfeltxu10s/c4JXg=
You will need the private key to configure the WireGuard connection on the local host. Do not share the private key.
Display the public key:
# cat /etc/wireguard/$HOSTNAME.public.key UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE=
You will need the public key to configure the WireGuard connection on the remote host.
Additional resources
-
wg(8)
man page on your system
7.5. Configuring a WireGuard server by using nmcli
You can configure the WireGuard server by creating a connection profile in NetworkManager. Use this method to let NetworkManager manage the WireGuard connection.
This procedure assumes the following settings:
Server:
-
Private key:
YFAnE0psgIdiAF7XR4abxiwVRnlMfeltxu10s/c4JXg=
-
Tunnel IPv4 address:
192.0.2.1/24
-
Tunnel IPv6 address:
2001:db8:1::1/32
-
Private key:
Client:
-
Public key:
bnwfQcC8/g2i4vvEqcRUM2e6Hi3Nskk6G9t4r26nFVM=
-
Tunnel IPv4 address:
192.0.2.2/24
-
Tunnel IPv6 address:
2001:db8:1::2/32
-
Public key:
Prerequisites
- You have generated the public and private key for both the server and client.
You know the following information:
- The private key of the server
- The static tunnel IP addresses and subnet masks of the client
- The public key of the client
- The static tunnel IP addresses and subnet masks of the server
Procedure
Add a NetworkManager WireGuard connection profile:
# nmcli connection add type wireguard con-name server-wg0 ifname wg0 autoconnect no
This command creates a profile named
server-wg0
and assigns the virtual interfacewg0
to it. To prevent the connection from starting automatically after you add it without finalizing the configuration, disable theautoconnect
parameter.Set the tunnel IPv4 address and subnet mask of the server:
# nmcli connection modify server-wg0 ipv4.method manual ipv4.addresses 192.0.2.1/24
Set the tunnel IPv6 address and subnet mask of the server:
# nmcli connection modify server-wg0 ipv6.method manual ipv6.addresses 2001:db8:1::1/32
Add the server’s private key to the connection profile:
# nmcli connection modify server-wg0 wireguard.private-key "YFAnE0psgIdiAF7XR4abxiwVRnlMfeltxu10s/c4JXg="
Set the port for incoming WireGuard connections:
# nmcli connection modify server-wg0 wireguard.listen-port 51820
Always set a fixed port number on hosts that receive incoming WireGuard connections. If you do not set a port, WireGuard uses a random free port each time you activate the
wg0
interface.Add peer configurations for each client that you want to allow to communicate with this server. You must add these settings manually, because the
nmcli
utility does not support setting the corresponding connection properties.Edit the
/etc/NetworkManager/system-connections/server-wg0.nmconnection
file, and append:[wireguard-peer.bnwfQcC8/g2i4vvEqcRUM2e6Hi3Nskk6G9t4r26nFVM=] allowed-ips=192.0.2.2;2001:db8:1::2;
-
The
[wireguard-peer.<public_key_of_the_client>]
entry defines the peer section of the client, and the section name contains the public key of the client. The
allowed-ips
parameter sets the tunnel IP addresses of the client that are allowed to send data to this server.Add a section for each client.
-
The
Reload the
server-wg0
connection profile:# nmcli connection load /etc/NetworkManager/system-connections/server-wg0.nmconnection
Optional: Configure the connection to start automatically, enter:
# nmcli connection modify server-wg0 autoconnect yes
Reactivate the
server-wg0
connection:# nmcli connection up server-wg0
Verification
Display the interface configuration of the
wg0
device:# wg show wg0 interface: wg0 public key: UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE= private key: (hidden) listening port: 51820 peer: bnwfQcC8/g2i4vvEqcRUM2e6Hi3Nskk6G9t4r26nFVM= allowed ips: 192.0.2.2/32, 2001:db8:1::2/128
To display the private key in the output, use the
WG_HIDE_KEYS=never wg show wg0
command.Display the IP configuration of the
wg0
device:# ip address show wg0 20: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000 link/none inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute wg0 valid_lft forever preferred_lft forever inet6 2001:db8:1::1/32 scope global noprefixroute valid_lft forever preferred_lft forever inet6 fe80::3ef:8863:1ce2:844/64 scope link noprefixroute valid_lft forever preferred_lft forever
Additional resources
-
wg(8)
man page on your system -
The
WireGuard setting
section in thenm-settings(5)
man page on your system
7.6. Configuring a WireGuard server by using nmtui
You can configure the WireGuard server by creating a connection profile in NetworkManager. Use this method to let NetworkManager manage the WireGuard connection.
This procedure assumes the following settings:
Server:
-
Private key:
YFAnE0psgIdiAF7XR4abxiwVRnlMfeltxu10s/c4JXg=
-
Tunnel IPv4 address:
192.0.2.1/24
-
Tunnel IPv6 address:
2001:db8:1::1/32
-
Private key:
Client:
-
Public key:
bnwfQcC8/g2i4vvEqcRUM2e6Hi3Nskk6G9t4r26nFVM=
-
Tunnel IPv4 address:
192.0.2.2/24
-
Tunnel IPv6 address:
2001:db8:1::2/32
-
Public key:
Prerequisites
- You have generated the public and private key for both the server and client.
You know the following information:
- The private key of the server
- The static tunnel IP addresses and subnet masks of the client
- The public key of the client
- The static tunnel IP addresses and subnet masks of the server
-
You installed the
NetworkManager-tui
package.
Procedure
Start the
nmtui
application:# nmtui
- Select Edit a connection, and press Enter.
- Select , and press Enter.
- Select the WireGuard connection type in the list, and press Enter.
In the Edit connection window:
-
Enter the name of the connection and the virtual interface, such as
wg0
, that NetworkManager should assign to the connection. - Enter the private key of the server.
Set the listen port number, such as
51820
, for incoming WireGuard connections.Always set a fixed port number on hosts that receive incoming WireGuard connections. If you do not set a port, WireGuard uses a random free port each time you activate the interface.
Click Peers pane:
next to the- Enter the public key of the client.
- Set the Allowed IPs field to the tunnel IP addresses of the client that are allowed to send data to this server.
Select
, and press Enter.
Select
next to *IPv4 Configuration, and press Enter.- Select the IPv4 configuration method Manual.
- Enter the tunnel IPv4 address and the subnet mask. Leave the Gateway field empty.
Select IPv6 Configuration, and press Enter.
next to- Select the IPv6 configuration method Manual.
-
Enter the tunnel IPv6 address and the subnet mask. Leave the
Gateway
field empty.
Select
, and press Enter
-
Enter the name of the connection and the virtual interface, such as
- In the window with the list of connections, select , and press Enter.
- In the NetworkManager TUI main window, select , and press Enter.
Verification
Display the interface configuration of the
wg0
device:# wg show wg0 interface: wg0 public key: UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE= private key: (hidden) listening port: 51820 peer: bnwfQcC8/g2i4vvEqcRUM2e6Hi3Nskk6G9t4r26nFVM= allowed ips: 192.0.2.2/32, 2001:db8:1::2/128
To display the private key in the output, use the
WG_HIDE_KEYS=never wg show wg0
command.Display the IP configuration of the
wg0
device:# ip address show wg0 20: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000 link/none inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute wg0 valid_lft forever preferred_lft forever inet6 _2001:db8:1::1/32 scope global noprefixroute valid_lft forever preferred_lft forever inet6 fe80::3ef:8863:1ce2:844/64 scope link noprefixroute valid_lft forever preferred_lft forever
Additional resources
-
wg(8)
man page on your system
7.7. Configuring a WireGuard server by using the RHEL web console
You can configure a WireGuard server by using the browser-based RHEL web console. Use this method to let NetworkManager manage the WireGuard connection.
Prerequisites
- You are logged in to the RHEL web console.
You know the following information:
- The static tunnel IP addresses and subnet masks of both the server and client
- The public key of the client
Procedure
- Select the Networking tab in the navigation on the left side of the screen.
- Click Add VPN in the Interfaces section.
-
If the
wireguard-tools
andsystemd-resolved
packages are not already installed, the web console displays a corresponding notification. Click Install to install these packages. - Enter the name of the WireGuard device that you want to create.
Configure the key pair of this host:
If you want use the keys that the web console has created:
- Keep the pre-selected Generated option in the Private key area.
- Note the Public key value. You require this information when you configure the client.
If you want to use an existing private key:
- Select Paste existing key in the Private key area.
- Paste the private key into the text field. The web console automatically calculates the corresponding public key.
Set a listen port number, such as
51820
, for incoming WireGuard connections.Always set a fixed port number on hosts that receive incoming WireGuard connections. If you do not set a port, WireGuard uses a random free port each time you activate the interface.
Set the tunnel IPv4 address and subnet mask of the server.
To also set an IPv6 address, you must edit the connection after you have created it.
Add peer configurations for each client that you want to allow to communicate with this server:
- Click Add peer.
- Enter the public key of the client.
- Leave the Endpoint field empty.
- Set the Allowed IPs field to the tunnel IP addresses of the clients that are allowed to send data to this server.
- Click Add to create the WireGuard connection.
If you want to also set a tunnel IPv6 address:
- Click on the WireGuard connection’s name in the Interfaces section.
- Click edit next to IPv6.
-
Set the Addresses field to
Manual
, and enter the tunnel IPv6 address and prefix of the server. - Click Save.
Verification
Display the interface configuration of the
wg0
device:# wg show wg0 interface: wg0 public key: UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE= private key: (hidden) listening port: 51820 peer: bnwfQcC8/g2i4vvEqcRUM2e6Hi3Nskk6G9t4r26nFVM= allowed ips: 192.0.2.2/32, 2001:db8:1::2/128
To display the private key in the output, use the
WG_HIDE_KEYS=never wg show wg0
command.Display the IP configuration of the
wg0
device:# ip address show wg0 20: wg0: <POINTOPOINT,NOARP,UP,LOWERUP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000 link/none inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute wg0 valid_lft forever preferred_lft forever inet6 2001:db8:1::1/32 scope global noprefixroute valid_lft forever preferred_lft forever inet6 fe80::3ef:8863:1ce2:844/64 scope link noprefixroute valid_lft forever preferred_lft forever
7.8. Configuring firewalld
on a WireGuard server by using the command line
You must configure the firewalld
service on the WireGuard server to allow incoming connections from clients. Additionally, if clients should be able to use the WireGuard server as the default gateway and route all traffic through the tunnel, you must enable masquerading.
Procedure
Open the WireGuard port for incoming connections in the
firewalld
service:# firewall-cmd --permanent --add-port=51820/udp --zone=public
If clients should route all traffic through the tunnel and use the WireGuard server as the default gateway, enable masquerading for the
public
zone:# firewall-cmd --permanent --zone=public --add-masquerade
Reload the
firewalld
rules.# firewall-cmd --reload
Verification
Display the configuration of the
public
zone:# firewall-cmd --list-all public (active) ... ports: 51820/udp masquerade: yes ...
Additional resources
-
firewall-cmd(1)
man page on your system
7.9. Configuring firewalld
on a WireGuard server by using the RHEL web console
You must configure the firewalld service on the WireGuard server to allow incoming connections from clients. Additionally, if clients should be able to use the WireGuard server as the default gateway and route all traffic through the tunnel, you must enable masquerading.
Prerequisites
- You are logged in to the RHEL web console.
Procedure
- Select the Networking tab in the navigation on the left side of the screen.
- Click Edit rules and zones in the Firewall section.
-
Enter
wireguard
into the Filter services field. Select the
wireguard
entry from the list.- Click Add services.
If clients should route all traffic through the tunnel and use the WireGuard server as the default gateway, enable masquerading for the
public
zone:# firewall-cmd --permanent --zone=public --add-masquerade # firewall-cmd --reload
Note that you cannot enable masquerading in
firewalld
zones in the web console.
Verification
- Select the Networking tab in the navigation on the left side of the screen.
- Click Edit rules and zones in the Firewall section.
-
The list contains an entry for the
wireguard
service and displays the UDP port that you configured in the WireGuard connection profile. To verify that masquerading is enabled in the
firewalld
public
zone, enter:# firewall-cmd --list-all --zone=public public (active) ... ports: 51820/udp masquerade: yes ...
7.10. Configuring a WireGuard client by using nmcli
You can configure a WireGuard client by creating a connection profile in NetworkManager. Use this method to let NetworkManager manage the WireGuard connection.
This procedure assumes the following settings:
Client:
-
Private key:
aPUcp5vHz8yMLrzk8SsDyYnV33IhE/k20e52iKJFV0A=
-
Tunnel IPv4 address:
192.0.2.2/24
-
Tunnel IPv6 address:
2001:db8:1::2/32
-
Private key:
Server:
-
Public key:
UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE=
-
Tunnel IPv4 address:
192.0.2.1/24
-
Tunnel IPv6 address:
2001:db8:1::1/32
-
Public key:
Prerequisites
- You have generated the public and private key for both the server and client.
You know the following information:
- The private key of the client
- The static tunnel IP addresses and subnet masks of the client
- The public key of the server
- The static tunnel IP addresses and subnet masks of the server
Procedure
Add a NetworkManager WireGuard connection profile:
# nmcli connection add type wireguard con-name client-wg0 ifname wg0 autoconnect no
This command creates a profile named
client-wg0
and assigns the virtual interfacewg0
to it. To prevent the connection from starting automatically after you add it without finalizing the configuration, disable theautoconnect
parameter.Optional: Configure NetworkManager so that it does not automatically start the
client-wg
connection:# nmcli connection modify client-wg0 autoconnect no
Set the tunnel IPv4 address and subnet mask of the client:
# nmcli connection modify client-wg0 ipv4.method manual ipv4.addresses 192.0.2.2/24
Set the tunnel IPv6 address and subnet mask of the client:
# nmcli connection modify client-wg0 ipv6.method manual ipv6.addresses 2001:db8:1::2/32
If you want to route all traffic through the tunnel, set the tunnel IP addresses of the server as the default gateway:
# nmcli connection modify client-wg0 ipv4.gateway 192.0.2.1 ipv6.gateway 2001:db8:1::1
Routing all traffic through the tunnel requires that you set, in a later step, the
allowed-ips
on the this client to0.0.0.0/0;::/0
.Note that routing all traffic through the tunnel can impact the connectivity to other hosts based on the server routing and firewall configuration.
Add the client’s private key to the connection profile:
# nmcli connection modify client-wg0 wireguard.private-key "aPUcp5vHz8yMLrzk8SsDyYnV33IhE/k20e52iKJFV0A="
Add peer configurations for each server that you want to allow to communicate with this client. You must add these settings manually, because the
nmcli
utility does not support setting the corresponding connection properties.Edit the
/etc/NetworkManager/system-connections/client-wg0.nmconnection
file, and append:[wireguard-peer.UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE=] endpoint=server.example.com:51820 allowed-ips=192.0.2.1;2001:db8:1::1; persistent-keepalive=20
-
The
[wireguard-peer.<public_key_of_the_server>]
entry defines the peer section of the server, and the section name has the public key of the server. -
The
endpoint
parameter sets the hostname or IP address and the port of the server. The client uses this information to establish the connection. The
allowed-ips
parameter sets a list of IP addresses that can send data to this client. For example, set the parameter to:- The tunnel IP addresses of the server to allow only the server to communicate with this client. The value in the example above configures this scenario.
-
0.0.0.0/0;::/0;
to allow any remote IPv4 and IPv6 address to communicate with this client. Use this setting to route all traffic through the tunnel and use the WireGuard server as default gateway.
-
The optional
persistent-keepalive
parameter defines an interval in seconds in which WireGuard sends a keep alive packet to the server. Set this parameter if you use the client in a network with network address translation (NAT) or if a firewall closes the UDP connection after some time of inactivity.
-
The
Reload the
client-wg0
connection profile:# nmcli connection load /etc/NetworkManager/system-connections/client-wg0.nmconnection
Reactivate the
client-wg0
connection:# nmcli connection up client-wg0
Verification
Ping the IP addresses of the server:
# ping 192.0.2.1 # ping6 2001:db8:1::1
Display the interface configuration of the
wg0
device:# wg show wg0 interface: wg0 public key: bnwfQcC8/g2i4vvEqcRUM2e6Hi3Nskk6G9t4r26nFVM= private key: (hidden) listening port: 51820 peer: UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE= endpoint: server.example.com:51820 allowed ips: 192.0.2.1/32, 2001:db8:1::1/128 latest handshake: 1 minute, 41 seconds ago transfer: 824 B received, 1.01 KiB sent persistent keepalive: every 20 seconds
To display the private key in the output, use the
WG_HIDE_KEYS=never wg show wg0
command.Note that the output has only the
latest handshake
andtransfer
entries if you have already sent traffic through the VPN tunnel.Display the IP configuration of the
wg0
device:# ip address show wg0 10: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000 link/none inet 192.0.2.2/24 brd 192.0.2.255 scope global noprefixroute wg0 valid_lft forever preferred_lft forever inet6 2001:db8:1::2/32 scope global noprefixroute valid_lft forever preferred_lft forever inet6 fe80::73d9:6f51:ea6f:863e/64 scope link noprefixroute valid_lft forever preferred_lft forever
Additional resources
-
wg(8)
man page on your system -
The
WireGuard setting
section in thenm-settings(5)
man page on your system
7.11. Configuring a WireGuard client by using nmtui
You can configure a WireGuard client by creating a connection profile in NetworkManager. Use this method to let NetworkManager manage the WireGuard connection.
This procedure assumes the following settings:
Client:
-
Private key:
aPUcp5vHz8yMLrzk8SsDyYnV33IhE/k20e52iKJFV0A=
-
Tunnel IPv4 address:
192.0.2.2/24
-
Tunnel IPv6 address:
2001:db8:1::2/32
-
Private key:
Server:
-
Public key:
UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE=
-
Tunnel IPv4 address:
192.0.2.1/24
-
Tunnel IPv6 address:
2001:db8:1::1/32
-
Public key:
Prerequisites
- You have generated the public and private key for both the server and client.
You know the following information:
- The private key of the client
- The static tunnel IP addresses and subnet masks of the client
- The public key of the server
- The static tunnel IP addresses and subnet masks of the server
-
You installed the
NetworkManager-tui
package
Procedure
Start the
nmtui
application:# nmtui
- Select Edit a connection, and press Enter.
- Select , and press Enter.
- Select the WireGuard connection type in the list, and press Enter.
In the Edit connection window:
-
Enter the name of the connection and the virtual interface, such as
wg0
, that NetworkManager should assign to the connection. Enter the private key of the client.
Click Peers pane:
next to the- Enter the public key of the server.
Set the Allowed IPs field. For example, set it to:
- The tunnel IP addresses of the server to allow only the server to communicate with this client.
-
0.0.0.0/0,::/0
to allow any remote IPv4 and IPv6 address to communicate with this client. Use this setting to route all traffic through the tunnel and use the WireGuard server as default gateway.
-
Enter the host name or IP address and port of the WireGuard server into the Endpoint field. Use the following format:
<hostname_or_IP>:<port_number>
- Optional: If you use the client in a network with network address translation (NAT) or if a firewall closes the UDP connection after some time of inactivity, set a persistent keep alive interval in seconds. In this interval, the client sends a keepalive packet to the server.
Select
, and press Enter.
Select IPv4 Configuration, and press Enter.
next to- Select the IPv4 configuration method Manual.
- Enter the tunnel IPv4 address and the subnet mask. Leave the Gateway field empty.
Select IPv6 Configuration, and press Enter.
next to- Select the IPv6 configuration method Manual.
- Enter the tunnel IPv6 address and the subnet mask. Leave the Gateway field empty.
- Optional: Select Automatically connect.
Select
, and press Enter
-
Enter the name of the connection and the virtual interface, such as
- In the window with the list of connections, select , and press Enter.
- In the NetworkManager TUI main window, select , and press Enter.
Verification
Ping the IP addresses of the server:
# ping 192.0.2.1 # ping6 2001:db8:1::1
Display the interface configuration of the
wg0
device:# wg show wg0 interface: wg0 public key: bnwfQcC8/g2i4vvEqcRUM2e6Hi3Nskk6G9t4r26nFVM= private key: (hidden) listening port: 51820 peer: UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE= endpoint: server.example.com:51820_ allowed ips: 192.0.2.1/32, 2001:db8:1::1/128 latest handshake: 1 minute, 41 seconds ago transfer: 824 B received, 1.01 KiB sent persistent keepalive: every 20 seconds
To display the private key in the output, use the
WG_HIDE_KEYS=never wg show wg0
command.Note that the output contains only the
latest handshake
andtransfer
entries if you have already sent traffic through the VPN tunnel.Display the IP configuration of the
wg0
device:# ip address show wg0 10: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000 link/none inet 192.0.2.2/24 brd 192.0.2.255 scope global noprefixroute wg0 valid_lft forever preferred_lft forever inet6 2001:db8:1::2/32 scope global noprefixroute valid_lft forever preferred_lft forever inet6 fe80::73d9:6f51:ea6f:863e/64 scope link noprefixroute valid_lft forever preferred_lft forever
Additional resources
-
wg(8)
man page on your system
7.12. Configuring a WireGuard client by using the RHEL web console
You can configure a WireGuard client by using the browser-based RHEL web console. Use this method to let NetworkManager manage the WireGuard connection.
Prerequisites
- You are logged in to the RHEL web console.
You know the following information:
- The static tunnel IP addresses and subnet masks of both the server and client
- The public key of the server
Procedure
- Select the Networking tab in the navigation on the left side of the screen.
- Click Add VPN in the Interfaces section.
-
If the
wireguard-tools
andsystemd-resolved
packages are not already installed, the web console displays a corresponding notification. Click Install to install these packages. - Enter the name of the WireGuard device that you want to create.
Configure the key pair of this host:
If you want use the keys that the web console has created:
- Keep the pre-selected Generated option in the Private key area.
- Note the Public key value. You require this information when you configure the client.
If you want to use an existing private key:
- Select Paste existing key in the Private key area.
- Paste the private key into the text field. The web console automatically calculates the corresponding public key.
-
Preserve the
0
value in the Listen port field. Set the tunnel IPv4 address and subnet mask of the client.
To also set an IPv6 address, you must edit the connection after you have created it.
Add a peer configuration for the server that you want to allow to communicate with this client:
- Click Add peer.
- Enter the public key of the server.
-
Set the Endpoint field to the hostname or IP address and the port of the server, for example
server.example.com:51820
. The client uses this information to establish the connection. Set the Allowed IPs field to the tunnel IP addresses of the clients that are allowed to send data to this server. For example, set the field to one of the following:
- The tunnel IP addresses of the server to allow only the server to communicate with this client. The value in the screen capture below configures this scenario.
-
0.0.0.0/0
to allow any remote IPv4 address to communicate with this client. Use this setting to route all traffic through the tunnel and use the WireGuard server as default gateway.
- Click Add to create the WireGuard connection.
If you want to also set a tunnel IPv6 address:
- Click on the WireGuard connection’s name in the Interfaces section.
- Click Edit next to IPv6.
-
Set the Addresses field to
Manual
, and enter the tunnel IPv6 address and prefix of the client. - Click Save.
Verification
Ping the IP addresses of the server:
# ping 192.0.2.1
WireGuard establishes the connection when you try to send traffic through the tunnel.
Display the interface configuration of the
wg0
device:# wg show wg0 interface: wg0 public key: bnwfQcC8/g2i4vvEqcRUM2e6Hi3Nskk6G9t4r26nFVM= private key: (hidden) listening port: 45513 peer: UtjqCJ57DeAscYKRfp7cFGiQqdONRn69u249Fa4O6BE= endpoint: server.example.com:51820 allowed ips: 192.0.2.1/32, 2001:db8:1::1/128 latest handshake: 1 minute, 41 seconds ago transfer: 824 B received, 1.01 KiB sent persistent keepalive: every 20 seconds
To display the private key in the output, use the
WG_HIDE_KEYS=never wg show wg0
command.Note that the output has only the
latest handshake
andtransfer
entries if you have already sent traffic through the VPN tunnel.Display the IP configuration of the
wg0
device:# ip address show wg0 10: wg0: <POINTOPOINT,NOARP,UP,LOWERUP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000 link/none inet 192.0.2.2/24 brd 192.0.2.255 scope global noprefixroute wg0 valid_lft forever preferred_lft forever inet6 2001:db8:1::2/32 scope global noprefixroute valid_lft forever preferred_lft forever inet6 fe80::73d9:6f51:ea6f:863e/64 scope link noprefixroute valid_lft forever preferred_lft forever