Start, test, and remove WireGuard

Open the narrow UDP path first. Allow UDP port 51820 in the host and provider firewalls:

sudo ufw allow 51820/udp

Remember the provider side too — a cloud security group that drops UDP will make everything below fail silently.

Start the server interface with sudo systemctl enable --now wg-quick@wg0. That starts it now and at every boot. wg-quick reads /etc/wireguard/wg0.conf, creates wg0, assigns the address, and installs the routes.

Start the laptop interface, then inspect what got created with wg show and ip route:

sudo wg-quick up wg0
sudo wg show
# peer: SERVER_PUBLIC_KEY
#   endpoint: 203.0.113.10:51820
#   latest handshake: 12 seconds ago
#   transfer: 3.41 KiB received, 4.72 KiB sent

ip route | grep wg0
# 10.14.0.0/24 dev wg0 proto kernel scope link src 10.14.0.2

Two lines matter: a recent latest handshake, and a route sending 10.14.0.0/24 into wg0.

Now the real test. Ping 10.14.0.1 from the laptop:

ping -c 3 10.14.0.1
# 64 bytes from 10.14.0.1: icmp_seq=1 ttl=64 time=18.3 ms

Replies prove the whole chain at once: routing into the tunnel, encryption in both directions, and a live interface on the server. If SSH to the server’s VPN address works too, you have a private management path that no longer depends on the public one.

If it fails, check the endpoint, keys, AllowedIPs, firewall, routes, and latest handshake in that order. The handshake line splits the problem in half: no handshake means the first four items, a handshake without ping replies means the last two. Resist the urge to change several things between attempts — you will fix it and not know which change mattered.

Removal is part of the exercise, because revoking access cleanly is a skill you will need in production. To remove the lab, stop and disable the service, remove the narrow firewall rule, and delete the peer configuration and keys securely:

sudo wg-quick down wg0                        # on the laptop
sudo systemctl disable --now wg-quick@wg0     # on the server
sudo ufw delete allow 51820/udp
sudo shred -u /etc/wireguard/wg0.conf

Then remove the server when it was created only for this exercise. A forgotten VPN server with valid peer keys is standing access nobody remembers granting.