Compiling the Kernel Module from Source

You will need gcc ≥4.7, your kernel headers in the right location for compilation, as well as libmnl for building the userspace wg(8) utility.

Step 1: Install the toolchain

Ubuntu and Debian

$ sudo apt-get install libmnl-dev libelf-dev linux-headers-$(uname -r) build-essential pkg-config

Fedora

$ sudo dnf install libmnl-devel elfutils-libelf-devel kernel-devel pkg-config @development-tools

Red Hat Enterprise Linux / CentOS

$ sudo yum install libmnl-devel elfutils-libelf-devel kernel-devel pkgconfig "@Development Tools"

Arch

# pacman -S libmnl linux-headers base-devel pkg-config

Gentoo

# emerge libmnl

OpenSUSE

$ sudo zypper install kernel-default-devel libmnl-devel pkg-config

Alpine

# apk add build-base linux-hardened-dev libmnl-dev  # or linux-vanilla-dev on a vanilla kernel

Step 2: Grab the code

Either download the latest snapshot (recommended):

$ wget https://git.zx2c4.com/WireGuard/snapshot/WireGuard-.tar.xz

Or clone the git repository (unstable):

$ git clone https://git.zx2c4.com/WireGuard

Step 3: Compile the module and the wg(8) tool

$ cd WireGuard/src
$ make

(You may instead run make debug if you'd like to have additional information on what's happening in your dmesg(1).)

Step 4: As root, install it

# make install

Move on to the quick start walkthrough.

Kernel Requirements

WireGuard requires Linux ≥3.10, with the following configuration options, which are likely already configured in your kernel, especially if you're installing via distribution packages.

Some, but not all, of these options directly correspond to menuconfig entries. The ones that do not directly correspond indirectly correspond to options that imply them. For enabling the above options, select these items in menuconfig:

[*] Networking support -->
    Networking options -->
        [*] TCP/IP networking
        [*]   IP: Foo (IP protocols) over UDP
[*] Cryptographic API -->
    [*] Cryptographic algorithm manager

When building as an out of tree module, it is probable that one needs CONFIG_UNUSED_SYMBOLS set as well.

Building Directly In-Tree

Rather than building as an external module, if you would like to build WireGuard as a module or as built-in, directly from within the kernel tree, you may use the create-patch.sh script which creates a patch for adding WireGuard directly to the tree or the jury-rig.sh script which links the WireGuard source directory into the kernel tree:

$ cd /usr/src/linux
$ ~/wireguard/contrib/kernel-tree/create-patch.sh | patch -p1

    or

$ ~/wireguard/contrib/kernel-tree/jury-rig.sh /usr/src/linux

Then you will be able to configure these options directly:

These are selectable easily via menuconfig, if CONFIG_NET and CONFIG_INET are also selected:

[*] Networking support -->
    Networking options -->
        [*] TCP/IP networking
        [*]   IP: WireGuard secure network tunnel
        [ ]     Debugging checks and verbose messages