Start, test, and remove WireGuard

Time to turn it on. First we open the one UDP port the tunnel needs, on the server’s host firewall:

sudo ufw allow 51820/udp

Remember the provider side too. A cloud security group that drops UDP makes everything below fail silently, with no error anywhere.

Now start the server interface:

sudo systemctl enable --now wg-quick@wg0

That starts it now and at every boot. wg-quick reads /etc/wireguard/wg0.conf, creates wg0, assigns the address, and installs the routes.

Then start the laptop interface and inspect what got created:

sudo wg-quick up wg0
sudo wg show
# peer: SERVER_PUBLIC_KEY
#   endpoint: 203.0.113.10:51820
#   latest handshake: 12 seconds ago
#   transfer: 3.41 KiB received, 4.72 KiB sent

ip route | grep wg0
# 10.14.0.0/24 dev wg0 proto kernel scope link src 10.14.0.2

Two lines matter: a recent latest handshake, and a route sending 10.14.0.0/24 into wg0. If both are there, the hard part is done.

Now the real test. Ping the server’s VPN address from the laptop:

ping -c 3 10.14.0.1
# 64 bytes from 10.14.0.1: icmp_seq=1 ttl=64 time=18.3 ms

Replies prove the whole chain at once: routing into the tunnel, encryption in both directions, and a live interface on the server. Try ssh [email protected] too. If that works, you have a private management path that no longer depends on the public one.

If something fails, check in this order: endpoint, keys, AllowedIPs, firewall, routes, latest handshake. The handshake line splits the problem in half. No handshake means one of the first four items. A handshake without ping replies means one of the last two.

Resist the urge to change several things between attempts. You will fix it and not know which change mattered, and the next time it breaks you start from zero again.

Removal is part of the exercise. Revoking access cleanly is a skill you will need in production, and it is easier to practice on a lab than on a real system. Stop and disable the service, remove the firewall rule, and delete the config and keys securely:

sudo wg-quick down wg0                        # on the laptop
sudo systemctl disable --now wg-quick@wg0     # on the server
sudo ufw delete allow 51820/udp
sudo shred -u /etc/wireguard/wg0.conf

shred -u overwrites the file before deleting it, so the private key does not sit around in free disk blocks. Do the same for the loose .key files you created earlier.

Then remove the server itself if you created it only for this exercise. A forgotten VPN server with valid peer keys is standing access nobody remembers granting. I would rather rebuild the lab in ten minutes than leave that door open.