WireGuard Site-to-Site VPN on Linux

Connecting separate office locations or data centers securely over the public internet is a critical task for network engineers and system administrators. Traditional VPN solutions like IPsec or OpenVPN can be complex to configure and resource-heavy.

WireGuard provides an extremely fast, modern, and lean alternative that utilizes state-of-the-art cryptography. In this tutorial, we will walk through configuring a production-ready Site-to-Site WireGuard VPN connecting two Linux gateways.

---

Network Topology Overview

Before diving into configuration, let's define our environment topology:

• Site A (Headquarters):

  • Public IP: 203.0.113.10
  • Internal Subnet: 192.168.10.0/24
  • WireGuard Gateway Interface: wg0
  • WireGuard IP: 10.0.0.1/30

• Site B (Branch Office):

  • Public IP: 198.51.100.20
  • Internal Subnet: 192.168.20.0/24
  • WireGuard Gateway Interface: wg0
  • WireGuard IP: 10.0.0.2/30

---

Step 1: Installing WireGuard on Both Gateways

First, install WireGuard and necessary networking utilities on both Linux gateways (Debian/Ubuntu-based example):

bash
sudo apt update
sudo apt install -y wireguard iptables


(For RedHat/CentOS/Rocky Linux systems, use sudo dnf install -y wireguard-tools iptables).
Step 2: Enable IP Forwarding
For a Site-to-Site VPN, the Linux gateways must forward packets between internal subnets and the WireGuard interface.
On both Site A and Site B gateways, enable IP forwarding permanently:
echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p
Step 3: Key Generation
WireGuard uses public/private key pairs for peer authentication.
On Site A Gateway:
cd /etc/wireguard
umask 077
wg genkey | tee privatekey | wg pubkey > publickey
On Site B Gateway:
cd /etc/wireguard
umask 077
wg genkey | tee privatekey | wg pubkey > publickey
Note: Keep private keys strictly confidential and readable only by root.
Step 4: Configuring Site A Gateway (/etc/wireguard/wg0.conf)
Create the configuration file on Site A:

sudo nano /etc/wireguard/wg0.conf
Add the following content (replace keys with your actual generated keys):

[Interface]
Address = 10.0.0.1/30
ListenPort = 51820
PrivateKey = <SITE_A_PRIVATE_KEY>

# PostUp and PostDown rules for NAT routing across internal interface (eth0)
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# Site B Details
PublicKey = <SITE_B_PUBLIC_KEY>
Endpoint = 198.51.100.20:51820
# Allow WireGuard tunnel IP and Site B internal subnet
AllowedIPs = 10.0.0.2/32, 192.168.20.0/24
PersistentKeepalive = 25
Step 5: Configuring Site B Gateway (/etc/wireguard/wg0.conf)
Create the configuration file on Site B:
sudo nano /etc/wireguard/wg0.conf
Add the following content:
[Interface]
Address = 10.0.0.2/30
ListenPort = 51820
PrivateKey = <SITE_B_PRIVATE_KEY>

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# Site A Details
PublicKey = <SITE_A_PUBLIC_KEY>
Endpoint = 203.0.113.10:51820
# Allow WireGuard tunnel IP and Site A internal subnet
AllowedIPs = 10.0.0.1/32, 192.168.10.0/24
PersistentKeepalive = 25

Step 6: Starting and Enabling the WireGuard Tunnel
Start the interface and enable auto-start on boot for both gateways:
sudo systemctl enable --now wg-quick@wg0
Step 7: Verifying Tunnel and Route Connectivity
1. Check WireGuard Status
Execute the following command on either gateway to verify the active peer handshake:
sudo wg show

2. Test Ping Across Tunnels
From Site A Gateway, ping Site B's internal IP:
ping -c 4 10.0.0.2
ping -c 4 192.168.20.1
From a workstation inside Site A (192.168.10.50), ping a machine in Site B (192.168.20.50) to confirm cross-subnet routing.
Step 8: Adding Static Routes on Local Routers (Optional)
If your Linux gateways are separate from your core LAN routers, remember to add a static route on your primary LAN router:
Site A LAN Router: Destination 192.168.20.0/24 via Next Hop 192.168.10.X (Site A Linux Gateway).
Site B LAN Router: Destination 192.168.10.0/24 via Next Hop 192.168.20.X (Site B Linux Gateway).
Conclusion
WireGuard provides high-performance encrypted transport with minimal overhead compared to legacy VPN protocols. By enabling IP forwarding, setting precise AllowedIPs routing policies, and configuring iptables post-up actions, you can establish a secure and efficient site-to-site communication channel across remote sites.