WireGuard Client Setup and Disconnection on Ubuntu

Setting up and managing a WireGuard VPN client on Ubuntu is a fast and straightforward process, primarily using the command-line utility wg-quick.

1. Installation

WireGuard is available in the official Ubuntu repositories. You only need a couple of commands to get the necessary tools and kernel module installed.

1. Update your system’s package list:

sudo apt update

2. Install the WireGuard packages:

sudo apt install wireguard

2. Configuration

Before you can connect, you must have a configuration file, typically named [interface_name].conf (e.g., wg0.conf), provided by your VPN server administrator.

1. Place the configuration file in the correct directory. Assuming your file is named client.conf:

# Move your config file to the WireGuard directory
sudo mv ~/client.conf /etc/wireguard/

2. Ensure the file permissions are secure, as the configuration contains the private key:

sudo chmod 600 /etc/wireguard/client.conf

That chmod 600 isn’t a formality — the file holds your PrivateKey, and anyone who can read it can impersonate you on the VPN.

What’s actually in the config

The .conf your admin hands you is the whole client identity. A minimal one looks like this:

[Interface]
PrivateKey = <your private key>
Address = 10.0.0.2/32
DNS = 10.0.0.1

[Peer]
PublicKey = <server public key>
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0

The line that decides how much of your traffic goes through the tunnel is AllowedIPs:

• 0.0.0.0/0 — full tunnel: all IPv4 traffic, web browsing included, routes through the VPN. On a dual-stack machine add ::/0 as well (AllowedIPs = 0.0.0.0/0, ::/0), or IPv6 leaks out around the tunnel.
• specific subnets (e.g. 10.0.0.0/24) — split tunnel: only traffic to those networks uses the VPN; the rest goes out your normal connection.

If you only need to reach a few internal hosts, split tunneling keeps the rest of your traffic local and fast.

3. Connecting to the VPN

Use the wg-quick up command, followed by the interface name (the filename without the .conf extension), to bring the tunnel up.

1. Activate the WireGuard VPN tunnel:

sudo wg-quick up client

2. Verify the connection status and data transfer:

sudo wg

If you see a latest handshake time and a transfer data amount, your connection is successful.

4. Disconnecting the VPN

To securely close the VPN tunnel and remove the associated network interface and routing rules, use the wg-quick down command.

1. Deactivate the WireGuard VPN tunnel:

sudo wg-quick down client

This command automatically cleans up the virtual network interface, reverts the IP address and routing table changes, and effectively disconnects your system from the VPN.

Optional: Autostart on Boot

If you want the client to automatically connect every time your Ubuntu system starts, you can enable the systemd service for your configuration file:
(Replace client with your configuration file name).

sudo systemctl enable wg-quick@client

This is the client side. If you’re standing up the WireGuard server on another Ubuntu box, remember it listens on a UDP port (51820 by convention — WireGuard has no fixed default and picks a random port if ListenPort is unset) — that port has to be open in the firewall, which is a one-liner with UFW.