Skip to content
8Labs.
Blog
Client Panel

Assign Public IPv4 & IPv6 Wireguard Rocky Linux

Tested in Rocky Linux 9

Prerequisite

Section titled “Prerequisite”
  1. IPv4 allocation minimum /30 or IPv6
  2. Client Server
  3. VPS or VM for Wireguard Server
    • SELinux is running in permissive mode
Terminal window
setenforce permissive
reboot
- Disable Firewalld
Terminal window
systemctl stop firewalld
systemctl disable firewalld

Enable Wireguard Kernel Module

Section titled “Enable Wireguard Kernel Module”
Terminal window
modprobe wireguard
lsmod | grep wireguard
Terminal window
echo wireguard > /etc/modules-load.d/wireguard.conf

Install Wireguard

Section titled “Install Wireguard”
Terminal window
dnf install wireguard-tools

Generate Server Key Pair

Section titled “Generate Server Key Pair”
Terminal window
wg genkey | tee /etc/wireguard/server.key
chmod 0400 /etc/wireguard/server.key
Terminal window
cat /etc/wireguard/server.key | wg pubkey | tee /etc/wireguard/server.pub
Terminal window
cat /etc/wireguard/server.key
cat /etc/wireguard/server.pub

Generate Client Key Pair

Section titled “Generate Client Key Pair”
Terminal window
mkdir -p /etc/wireguard/clients
Terminal window
wg genkey | tee /etc/wireguard/clients/client1.key
cat /etc/wireguard/clients/client1.key | wg pubkey | tee /etc/wireguard/clients/client1.pub
Terminal window
cat /etc/wireguard/clients/client1.key
cat /etc/wireguard/clients/client1.pub

Configure Wireguard - Server Side

Section titled “Configure Wireguard - Server Side”
Terminal window
vi /etc/wireguard/wg0.conf

Server Side Configuration

Section titled “Server Side Configuration”
Terminal window
[Interface]
# Wireguard Server private key - server.key
PrivateKey = # Copy Server private key here
# Wireguard interface will be run at 10.8.0.1
Address = 10.8.0.1/24, fd00::1/64 #any IP private network


# Clients will connect to UDP port 51820
ListenPort = 51820


# Ensure any changes will be saved to the Wireguard config file
SaveConfig = true


# Change IPv6_CLIENT_ASSIGN to ipv6 public and ens33 to your interface
PostUp=ip -6 neigh add proxy IPv6_CLIENT_ASSIGN dev ens33
PostDown=ip -6 neigh del proxy IPv6_CLIENT_ASSIGN dev ens33


[Peer]
# Wireguard client public key - client1.pub
PublicKey = # Copy client public key here
# clients' VPN IP addresses you allow to connect
# possible to specify subnet ⇒ [172.16.100.0/24]
AllowedIPs = # copy IP Public/cidr

Port Forwarding

Section titled “Port Forwarding”
Terminal window
vi /etc/sysctl.conf
Terminal window
# Port Forwarding for IPv4
net.ipv4.ip_forward=1
net.ipv4.conf.all.proxy_arp=1


# Port forwarding for IPv6
net.ipv6.conf.all.forwarding=1
net.ipv6.conf.all.proxy_ndp=1
Terminal window
sysctl -p
reboot #prefered

Start Wireguard Server

Section titled “Start Wireguard Server”
Terminal window
systemctl start [email protected]
systemctl enable [email protected]
systemctl status [email protected]

Configure Wireguard - Client Side

Section titled “Configure Wireguard - Client Side”

This configuration is implemented on your client-side. Adjust based on your system.

Terminal window
vi /etc/wireguard/wg0.conf

Client Side Configuration

Section titled “Client Side Configuration”
Terminal window
[Interface]
Address = # copy ip public allocation for client
# Wireguard Client private key - client1.key
PrivateKey = # Copy client private key here


[Peer]
# Wireguard Server public key - server.pub
PublicKey = #Copy server public key here
AllowedIPs = 0.0.0.0/0,::/0 # makes your home server send all outbound packets via this tunnel
Endpoint = # copy wireguard ip public:port
# Sending Keepalive every 25 sec
PersistentKeepalive = 25

Maintainance Server

Section titled “Maintainance Server”

any change in wg0.conf need stop the wg first, update the conf, and start again.

Terminal window
wg-quick down /etc/wireguard/wg0.conf
wg-quick up /etc/wireguard/wg0.conf

Reference

Section titled “Reference”