Installation

Warning: WireGuard is currently under heavy development, and therefore any installation steps here should be considered as experimental. Please do not rely on WireGuard at this stage. We are rapidly working toward a first release that we will consider secure and ready for widespread usage, but that time has not yet come.

With that said, we are very excited to have people testing, experimenting, and reporting feedback. There are two ways to install WireGuard: from the source, or, if your distribution supports it yet, from distribution packages.

The latest snapshot is v.

Option A) Distribution Packages

As WireGuard nears closer to release time, distribution support will be much wider. For now, these four distributions provide packages:

Ubuntu [module & tools]

$ sudo add-apt-repository ppa:wireguard/wireguard
$ sudo apt-get update
$ sudo apt-get install wireguard-dkms wireguard-tools

Debian [sid – module, tools]

$ sudo apt install wireguard-dkms wireguard-tools

Fedora / CentOS [module & tools]

$ sudo dnf copr enable jdoss/wireguard
$ sudo dnf install kernel-devel wireguard-dkms wireguard-tools

Arch [module, tools]

$ sudo pacman -S wireguard-dkms wireguard-tools

You'll likely need to first have the headers for the Linux kernel installed, which could vary depending on your configuration, but probably you can simply use sudo pacman -S linux-headers.

OpenSUSE [module & tools]

$ sudo zypper addrepo -f http://download.opensuse.org/repositories/home:/mnhauke:/wireguard/$(sed -n 's/-/_/g;s/name=\(openSUSE_.*\)_Update/\1/p' /etc/zypp/repos.d/repo-update.repo)/home:mnhauke:wireguard.repo
$ sudo zypper install wireguard-kmp-default wireguard-tools

Gentoo [module & tools]

# emerge wireguard

Exherbo [module & tools]

# cave resolve -x wireguard

NixOS [module & tools]

boot.extraModulePackages = [ cfg.boot.kernelPackages.wireguard ];
environment.systemPackages = [ pkgs.wireguard ];

OpenWRT [module & tools]

# opkg install kmod-wireguard wireguard-tools

Further installation and configuration instructions may be found on the wiki.

Void [module & tools]

# xbps-install -S wireguard

Mac OS X [tools]

$ brew install wireguard-tools

Note that this will install the tools – wg(8) – only, to be used with a cross-platform userspace implementation of WireGuard.


Move on to the quick start walkthrough. Or, if your distribution isn't listed above, you may easily compile from source instead, a fairly simple procedure.

Option B) Compiling from Source

You will need gcc ≥4.7, your kernel headers in the right location for compilation, as well as libmnl for building the userspace wg(8) utility.

Step 1: Install the toolchain

Ubuntu and Debian
$ sudo apt-get install libmnl-dev linux-headers-$(uname -r) build-essential
Fedora
$ sudo dnf install libmnl-devel kernel-devel @development-tools
Arch
# pacman -S libmnl linux-headers base-devel
Gentoo
# emerge libmnl
OpenSUSE
$ sudo zypper install patterns-openSUSE-devel_kernel libmnl-devel

Step 2: Grab the code

Either download the latest snapshot (recommended):

$ wget https://git.zx2c4.com/WireGuard/snapshot/WireGuard-.tar.xz

Or clone the git repository (unstable):

$ git clone https://git.zx2c4.com/WireGuard

Step 3: Compile the module and the wg(8) tool

$ cd WireGuard/src
$ make

(You may instead run make debug if you'd like to have additional information on what's happening in your dmesg(1).)

Step 4: As root, install it

# make install

Move on to the quick start walkthrough.

Kernel Requirements

WireGuard requires Linux ≥3.18, with the following configuration options, which are likely already configured in your kernel, especially if you're installing via distribution packages, above.

Some, but not all, of these options directly correspond to menuconfig entries. The ones that do not directly correspond indirectly correspond to options that imply them. For enabling the above options, select these items in menuconfig:

[*] Networking support -->
    Networking options -->
        [*] TCP/IP networking
        [*]   IP: Foo (IP protocols) over UDP
        [*] Network packet filtering framework (Netfilter) -->
            [*] Advanced netfilter configuration
            Core Netfilter Configuration -->
                [*] Netfilter connection tracking support
                [*] Netfilter Xtables support
                [*]   "hashlimit" match support
            [*] IPv6: Netfilter Configuration (only if using IPv6)
[*] Cryptographic API -->
    [*] Cryptographic algorithm manager
    [*] Parallel crypto engine

Building Directly In-Tree

Rather than building as an external module, if you would like to build WireGuard as a module or as built-in, directly from within the kernel tree, you may use the create-patch.sh script which creates a patch for adding WireGuard directly to the tree or the jerry-rig.sh script which links the WireGuard source directory into the kernel tree:

$ cd /usr/src/linux
$ ~/wireguard/contrib/kernel-tree/create-patch.sh | patch -p1

    or

$ ~/wireguard/contrib/kernel-tree/jerry-rig.sh /usr/src/linux

Then you will be able to configure these options directly:

These are selectable easily via menuconfig, if CONFIG_NET and CONFIG_INET are also selected:

[*] Networking support -->
    Networking options -->
        [*] TCP/IP networking
        [*]   IP: WireGuard secure network tunnel
        [*]     Enable parallel engine
        [ ]     Debugging checks and verbose messages