Skip to content

WireGuard Server

Remote VPN access is provided by a dedicated WireGuard server running on hades.skynet.lan.

The server was deployed using the excellent angristan/wireguard-install installation script, which automates the installation, firewall configuration, IP forwarding, systemd service creation, and client management.

Project:

Installation

The installer was downloaded and executed on the server.

curl -O https://raw.githubusercontent.com/angristan/wireguard-install/master/wireguard-install.sh
chmod +x wireguard-install.sh
sudo ./wireguard-install.sh

The installation wizard automatically configured:

  • WireGuard packages
  • Server key pair
  • VPN interface
  • IP forwarding
  • Firewall/NAT rules
  • Systemd service
  • Initial client configuration

Server Configuration

Server information:

Setting Value
Hostname hades.skynet.lan
VPN Software WireGuard
Interface wg0
VPN Port 51820/UDP (or your configured port)
VPN Network <VPN_SUBNET> (leave default)
Public Hostname <vpn.mydomain.tld>

Generated Files

The installer creates the standard WireGuard configuration files.

Server configuration:

/etc/wireguard/wg0.conf

Client configurations are generated automatically.

Example:

/root/macbook.conf
/root/iphone.conf

Each client receives:

  • Unique key pair
  • VPN IP address
  • Server endpoint
  • DNS configuration

Hint

Use your PiHole as DNS.

Client Management

The installer can be executed again at any time.

sudo ./wireguard-install.sh

Available actions include:

  • Add a new client
  • Revoke an existing client
  • List configured clients
  • Remove the WireGuard server

No manual editing of wg0.conf is normally required.

Adding a New Device

To provision a new device:

  1. Run the installation script again.
  2. Select Add a new client.
  3. Enter a descriptive client name.
  4. A new client configuration file is generated.
  5. Import the configuration into the WireGuard application on the device.

Supported clients include:

  • Windows
  • macOS
  • Linux
  • iPhone / iPad
  • Android (Pending try)

WireGuard Service

Service status:

systemctl status wg-quick@wg0

Start:

systemctl start wg-quick@wg0

Stop:

systemctl stop wg-quick@wg0

Enable at boot:

systemctl enable wg-quick@wg0

Configuration Backup

The following files should be included in system backups:

/etc/wireguard/
/root/*.conf

These contain the server configuration and generated client profiles.

Notes

  • WireGuard is only exposed through a single UDP port.
  • Clients authenticate using public/private key pairs.
  • Access to the internal skynet.lan & internal zones is only available after successful authentication.
  • Client configurations can be regenerated or revoked at any time by rerunning the installer.