Traditional corporate VPN protocols like OpenVPN and IPsec are notoriously heavy. Their codebases span hundreds of thousands of lines, negotiation handshakes introduce latency, and client connections drop abruptly when transitioning between Wi-Fi and mobile networks.

WireGuard operates directly inside the Linux kernel using state-of-the-art cryptography (Noise protocol framework, Curve25519, ChaCha20-Poly1305, BLAKE2s). With fewer than 4,000 lines of code, it delivers near line-speed throughput, instant reconnections, and a minimal attack surface.

Server Gateway Setup (Ubuntu / Debian / Alpine)

1. Kernel Module Installation & Forwarding

bash
sudo apt update && sudo apt install -y wireguard iptables qrencode

# Enable IPv4 packet forwarding
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.d/99-wireguard.conf
sudo sysctl -p /etc/sysctl.d/99-wireguard.conf

2. Keypair Generation

Generate high-entropy private and public keypairs for the server and client:

bash
umask 077
wg genkey | tee server_private.key | wg pubkey > server_public.key
wg genkey | tee client_private.key | wg pubkey > client_public.key

3. Gateway Configuration (/etc/wireguard/wg0.conf)

ini
[Interface]
Address = 10.200.0.1/24
ListenPort = 51820
PrivateKey = <CONTENTS_OF_server_private.key>
# Firewall rules to masquerade traffic outbound to the internet
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

# Client Peer (Engineer Workstation)
[Peer]
PublicKey = <CONTENTS_OF_client_public.key>
AllowedIPs = 10.200.0.2/32

Enable and start the service:

bash
sudo systemctl enable --now wg-quick@wg0

Engineer Client Configuration

Create the client configuration profile (engineer-laptop.conf):

ini
[Interface]
Address = 10.200.0.2/24
PrivateKey = <CONTENTS_OF_client_private.key>
DNS = 1.1.1.1, 8.8.8.8

[Peer]
PublicKey = <CONTENTS_OF_server_public.key>
Endpoint = vpn.aebibtech.com:51820
# Split Tunneling: Only route private office subnets through the VPN
AllowedIPs = 10.200.0.0/24, 10.10.10.0/24
PersistentKeepalive = 25

Split Tunneling vs. Full Tunneling

  • Full Tunneling (`AllowedIPs = 0.0.0.0/0`): Encrypts all internet traffic (web browsing, streaming, Git) through the remote gateway. Excellent for untrusted public coffee shop Wi-Fi.
  • Split Tunneling (`AllowedIPs = 10.10.10.0/24, 10.200.0.0/24`): Directs only traffic intended for internal office servers through the encrypted tunnel. General web traffic exits via your local ISP, conserving server bandwidth.

    • Quick Mobile Pairing via QR Code

    Generate an instant terminal QR code to import configuration onto an iOS or Android device:

    bash
    qrencode -t ansiutf8 < engineer-laptop.conf

    Scan the terminal screen with the official WireGuard mobile app to establish an encrypted link within seconds.