Configuring WireGuard on CentOS, Debian, Ubuntu, and FreeBSD in four different ways

/en/linux/snippets/ wireguardcentosdebianubuntufreebsd
7/August/2026
authorRentaro
Rentaro
WireGuard 1600x896 wireguard.png
WireGuard

Below is a set of snippets for configuring WireGuard for three different Linux distributions and FreeBSD.
The setup assumes a Debian server with a 10.9.21.0/24 network.

Server, Debian

apt install wireguard-tools
nano /etc/network/interfaces.d/wg0

1
2
3
4
5
6
7
8

auto wg0
iface wg0 inet static
    address 10.9.21.1/32
    pre-up ip link add wg0 type wireguard
    pre-up wg setconf wg0 /etc/wireguard/wg0.conf
    up ip -4 route add 10.9.21.0/24 dev wg0
    # up /bin/systemctl restart sshd.service
    post-down ip link del wg0

umask 077
cd /etc/wireguard/
wg genkey > server-private.key
wg pubkey < server-private.key > server-public.key

nano /etc/wireguard/wg0.conf

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

[Interface]
ListenPort = 1234
PrivateKey = <server-private.key>

[Peer]
# Debian client
PublicKey = <public.key>
AllowedIPs = 10.9.21.3/32

[Peer]
# CentOS client
PublicKey = <public.key>
AllowedIPs = 10.9.21.4/32

[Peer]
# Ubuntu client
PublicKey = <public.key>
AllowedIPs = 10.9.21.5/32

[Peer]
# FreeBSD client
PublicKey = <public.key>
AllowedIPs = 10.9.21.6/32


Clients

By the way, Debian and FreeBSD are closest to a true UNIX-like style, whereas Ubuntu is more geared toward ‘yaml-production’, and CentOS relies on systemd. I mean their out-of-the-box states.

Debian: configuring the wg0 interface in interfaces.d

1
2
3
4

apt install wireguard
umask 077
wg genkey > /etc/wireguard/private.key
cat /etc/wireguard/private.key | wg pubkey > /etc/wireguard/public.key

nano /etc/network/interfaces.d/wg0

1
2
3
4
5
6
7

auto wg0
iface wg0 inet static
    address 10.9.21.3/32
    pre-up ip link add wg0 type wireguard
    pre-up wg setconf wg0 /etc/wireguard/wg0.conf
    up ip -4 route add 10.9.21.0/24 dev wg0
    post-down ip link del wg0

nano /etc/wireguard/wg0.conf

1
2
3
4
5
6
7
8
9

[Interface]
# client private key
PrivateKey = <private.key>
[Peer]
# server public key
PublicKey = <server-public.key>
Endpoint = <server-external-ip>:1234
PersistentKeepalive = 10
AllowedIPs = 10.9.21.0/24


CentOS: using systemd and wg-quick

1
2
3
4
5

dnf install epel-release -y
dnf install wireguard-tools -y
umask 077
wg genkey | sudo tee /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key
nano /etc/wireguard/wg0.conf

1
2
3
4
5
6
7
8

[Interface]
Address = 10.9.21.4/24
PrivateKey = <private.key>
[Peer]
PublicKey = <server-public.key>
Endpoint = <server-external-ip>:1234
PersistentKeepalive = 10
AllowedIPs = 10.9.21.0/24

1
2
3
4
5
6
7
8
9

printf 'net.ipv4.ip_forward = 1' > /etc/sysctl.d/wireguard.conf
sysctl -p
wg-quick up /etc/wireguard/wg0.conf
wg-quick down /etc/wireguard/wg0.conf
systemctl enable wg-quick@wg0
systemctl status wg-quick@wg0
ifconfig -a
wg show
journalctl -u wg-quick@wg0


Ubuntu: via Netplan

1
2
3
4

apt install wireguard
umask 077
wg genkey | tee /etc/wireguard/private.key | \
wg pubkey > /etc/wireguard/public.key


nano /etc/netplan/50-wireguard.yaml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

network:
  version: 2
  tunnels:
    wg0:
      mode: wireguard
      key: <private.key>
      addresses:
        - 10.9.21.5/24
      routes:
        - to: 10.9.21.0/24
          via: 10.9.21.1
      peers:
        - keys:
            public: <server-public.key>
          endpoint: <server-external-ip>:1234
          allowed-ips:
            - 10.9.21.0/24
          keepalive: 25

1
2
3
4
5

netplan apply
systemctl daemon-reload
systemctl restart netplan-configure.service
ifconfig -a
wg show


FreeBSD-way: using pure rc.conf

1
2
3
4
5
6

pkg update && pkg upgrade
pkg install wireguard-tools
chmod -R 750 /usr/local/etc/wireguard
cd /usr/local/etc/wireguard
umask 077
wg genkey | tee private.key | wg pubkey > public.key


nano /etc/rc.conf

1
2

cloned_interfaces="wg0"
ifconfig_wg0="inet 10.9.21.6/24 mtu 1420 up"


nano /etc/start_if.wg0

1

wg syncconf wg0 /usr/local/etc/wireguard/wg0.conf


nano /usr/local/etc/wireguard/wg0.conf

1
2
3
4
5
6
7
8

[Interface]
PrivateKey = <private.key>

[Peer]
PublicKey = <server-public.key>
AllowedIPs = 10.9.21.0/24
Endpoint = <server-external-ip>:1234
PersistentKeepalive = 25


While wg show will display the status of the wg0 interface, service wireguard status will not return any information because the interface is configured via sysrc | rc.conf.

Manual interface configuration

1
2
3
4
5
6
7
8

# up
ifconfig wg0 create
wg setconf wg0 /usr/local/etc/wireguard/wg0.conf
ifconfig wg0 inet 10.9.21.27/32 mtu 1420 up
route -q -n add -inet 10.9.21.0/24 -interface wg0
# down
ifconfig wg0 down
ifconfig wg0 destroy


Universal configuration for Linux

nano /etc/wireguard/wg0.conf

1
2
3
4
5
6
7
8
9

[Interface]
# client private key
PrivateKey = <private.key>
[Peer]
# server public key
PublicKey = <server-public.key>
Endpoint = <server-external-ip>:1234
PersistentKeepalive = 10
AllowedIPs = 10.9.21.0/24



1
2
3
4
5
6
7
8

ip link del wg0
ip link add wg0 type wireguard
wg setconf wg0 /etc/wireguard/wg0.conf
ip -4 address add 10.9.21.13/32 dev wg0
ip link set mtu 1420 up dev wg0
ip -4 route add 10.9.21.0/24 dev wg0
wg show
ping 10.9.21.1