Installation

Warning: WireGuard is currently under development, and therefore any installation steps here should be considered as experimental. We are rapidly working toward mainline inclusion, at which point we will consider this codebase non-experimental.

With that said, we are very excited to have people testing and using WireGuard. There are two ways to install WireGuard: from the source, or, if your distribution supports it yet, from distribution packages.

The latest snapshot is v.

Option A) Distribution Packages

The easiest way to get going with WireGuard is to install a package from your distribution:

Ubuntu [module & tools]

$ sudo add-apt-repository ppa:wireguard/wireguard
$ sudo apt-get update
$ sudo apt-get install wireguard-dkms wireguard-tools

Debian [module, tools]

# echo "deb http://deb.debian.org/debian/ unstable main" > /etc/apt/sources.list.d/unstable-wireguard.list
# printf 'Package: *\nPin: release a=unstable\nPin-Priority: 150\n' > /etc/apt/preferences.d/limit-unstable
# apt update
# apt install wireguard-dkms wireguard-tools

Fedora [module & tools]

$ sudo dnf copr enable jdoss/wireguard
$ sudo dnf install wireguard-dkms wireguard-tools

Red Hat Enterprise Linux / CentOS [module & tools]

$ sudo curl -Lo /etc/yum.repos.d/wireguard.repo https://copr.fedorainfracloud.org/coprs/jdoss/wireguard/repo/epel-7/jdoss-wireguard-epel-7.repo
$ sudo yum install epel-release
$ sudo yum install wireguard-dkms wireguard-tools

Arch [module, tools]

$ sudo pacman -S wireguard-dkms wireguard-tools

You'll likely need to first have the headers for the Linux kernel installed, which could vary depending on your configuration, but probably you can simply use sudo pacman -S linux-headers.

OpenSUSE [module & tools]

$ sudo zypper addrepo -f http://download.opensuse.org/repositories/home:/mnhauke:/wireguard/$(sed -n 's/-/_/g;s/name=\(openSUSE_.*\)_Update/\1/p' /etc/zypp/repos.d/repo-update.repo)/home:mnhauke:wireguard.repo
$ sudo zypper install wireguard-kmp-default wireguard-tools

Slackware [module & tools]

$ wget https://slackbuilds.org/slackbuilds/14.2/network/WireGuard.tar.gz && tar xzf WireGuard.tar.gz
$ cd WireGuard && OUTPUT=$(pwd) ./WireGuard.SlackBuild && sudo installpkg ./WireGuard-*.tgz

Alpine [module & tools]

# apk add -U wireguard-tools

You'll likely need to be on the edge repositories first, running a kernel from edge as well.

Gentoo [module & tools]

# emerge wireguard

Exherbo [module & tools]

# cave resolve -x wireguard

NixOS [module & tools]

boot.extraModulePackages = [ config.boot.kernelPackages.wireguard ];
environment.systemPackages = [ pkgs.wireguard ];

LEDE / OpenWRT [module & tools]

# opkg install kmod-wireguard wireguard-tools

Further installation and configuration instructions may be found on the wiki.

Void [module & tools]

# xbps-install -S wireguard

Buildroot [module & tools]

BR2_PACKAGE_WIREGUARD=y

EdgeOS [module & tools]

$ sudo dpkg -i wireguard-{octeon|ralink}-{version}.deb

First download the correct pre-built file from the release page, and then install it with dpkg as above.

LinuxKit [module & tools]

kernel:
  linuxkit/kernel:...
image:
  linuxkit/ip:...

Mac OS X [tools]

$ brew install wireguard-tools

Note that this will install the tools – wg(8) – only, to be used with a cross-platform userspace implementation of WireGuard.


Move on to the quick start walkthrough. Or, if your distribution isn't listed above, you may easily compile from source instead, a fairly simple procedure.

Option B) Compiling from Source

You will need gcc ≥4.7, your kernel headers in the right location for compilation, as well as libmnl for building the userspace wg(8) utility.

Step 1: Install the toolchain

Ubuntu and Debian
$ sudo apt-get install libmnl-dev linux-headers-$(uname -r) build-essential pkg-config
Fedora
$ sudo dnf install libmnl-devel kernel-devel @development-tools /usr/bin/pkg-config
Arch
# pacman -S libmnl linux-headers base-devel pkg-config
Gentoo
# emerge libmnl
OpenSUSE
$ sudo zypper install patterns-openSUSE-devel_kernel libmnl-devel pkg-config
Alpine
# apk add build-base linux-hardened-dev libmnl-dev  # or linux-vanilla-dev on a vanilla kernel

Step 2: Grab the code

Either download the latest snapshot (recommended):

$ wget https://git.zx2c4.com/WireGuard/snapshot/WireGuard-.tar.xz

Or clone the git repository (unstable):

$ git clone https://git.zx2c4.com/WireGuard

Step 3: Compile the module and the wg(8) tool

$ cd WireGuard/src
$ make

(You may instead run make debug if you'd like to have additional information on what's happening in your dmesg(1).)

Step 4: As root, install it

# make install

Move on to the quick start walkthrough.

Kernel Requirements

WireGuard requires Linux ≥3.10, with the following configuration options, which are likely already configured in your kernel, especially if you're installing via distribution packages, above.

Some, but not all, of these options directly correspond to menuconfig entries. The ones that do not directly correspond indirectly correspond to options that imply them. For enabling the above options, select these items in menuconfig:

[*] Networking support -->
    Networking options -->
        [*] TCP/IP networking
        [*]   IP: Foo (IP protocols) over UDP
[*] Cryptographic API -->
    [*] Cryptographic algorithm manager

Building Directly In-Tree

Rather than building as an external module, if you would like to build WireGuard as a module or as built-in, directly from within the kernel tree, you may use the create-patch.sh script which creates a patch for adding WireGuard directly to the tree or the jerry-rig.sh script which links the WireGuard source directory into the kernel tree:

$ cd /usr/src/linux
$ ~/wireguard/contrib/kernel-tree/create-patch.sh | patch -p1

    or

$ ~/wireguard/contrib/kernel-tree/jerry-rig.sh /usr/src/linux

Then you will be able to configure these options directly:

These are selectable easily via menuconfig, if CONFIG_NET and CONFIG_INET are also selected:

[*] Networking support -->
    Networking options -->
        [*] TCP/IP networking
        [*]   IP: WireGuard secure network tunnel
        [ ]     Debugging checks and verbose messages