Setting up a WireGuard VPN on Linux: the no-nonsense guide
On Linux, WireGuard is not an app you install: it already lives in the kernel. What you need is the tool that drives it (wireguard-tools) and a configuration file. Here is the full walkthrough — and above all, the two traps that will otherwise cost you an evening.
1. Install the tools
Debian, Ubuntu, Mint, MX Linux:
sudo apt install wireguard openresolv
Fedora: sudo dnf install wireguard-tools — Arch, Manjaro: sudo pacman -S wireguard-tools openresolv
2. Understand the configuration file
Everything lives in one .conf file. Whoever your provider is, it looks like this:
- [Interface] — your private key, your address inside the tunnel, the DNS servers to use, and the all-important
MTU. - [Peer] — the server's public key, its address (
Endpoint), andAllowedIPs = 0.0.0.0/0, ::/0, which means "send all my traffic through the tunnel".
That file holds your private key: never share it, and lock it down with chmod 600.
3. Install the profile and connect
The file name becomes the tunnel name:
sudo cp myvpn.conf /etc/wireguard/
sudo chmod 600 /etc/wireguard/myvpn.conf
sudo wg-quick up myvpn — and down to disconnect.
To start it at every boot: sudo systemctl enable wg-quick@myvpn
A button in your system tray
If you would rather click than type, import the profile into NetworkManager:
sudo nmcli connection import type wireguard file myvpn.conf
The VPN then shows up in the network menu: one click on, one click off.
Trap #1: the file name
Plenty of providers ship files named myvpn-fr_8421b885e85bb641.conf. The import will fail with a cryptic complaint about a "valid interface name": Linux caps network interface names at 15 characters. Rename the file to something short (france.conf) and it just works.
Trap #2: the tunnel is up, but nothing loads
The classic symptom: sudo wg show reports a recent handshake, so the server is answering… yet the browser spins forever. Two causes, in this order:
- DNS. Without
openresolv, the VPN's DNS servers never get applied. Install it and restart the tunnel. - Another VPN is already running. Tailscale, ZeroTier, a forgotten OpenVPN: two VPNs fight over the routing table and DNS, and neither works. Stop the other one (
sudo systemctl stop tailscaled, for instance) before connecting.
Check that it actually works
One command settles it: curl https://api.ipify.org. If the address shown is your VPN server's, all your traffic really is leaving through the tunnel. If it is still your ISP's, the VPN is doing nothing for you.
The easy way
At VPN Paris we packaged all of this into a Linux client: sudo vpnparis signup you@email.com creates the account and the configuration (MTU included), sudo vpnparis up connects, and sudo vpnparis status prints your public IP. Dependencies — openresolv included — are pulled in for you. Everything above still applies to any WireGuard provider, and our Linux page documents both routes.