VPN

Saphira Linux vpnDragon

Run WireGuard on infrastructure you control, connect your devices to it, and remove the unnecessary mystery from secure remote connectivity.

In testing, functionality present — helpers missing

Install WireGuard on Saphira

Install the WireGuard userspace tools from Saphira packages. The Linux kernel carries the WireGuard interface support; wireguard-tools provides wg and wg-quick. nftables provides the firewall tools used later in this guide.

apk update
apk add wireguard-tools nftables

# Confirm the commands are present
command -v wg wg-quick nft

wg-quick reads interface configurations from /etc/wireguard. The conventional first interface is wg0, stored as /etc/wireguard/wg0.conf. Keep the directory and every private-key-bearing configuration readable only by root.

install -d -m 700 /etc/wireguard
umask 077
wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub
cat /etc/wireguard/server.pub

WarningPrivate keys are secrets. The addresses, keys and host names below are documentation values only. Never paste a real private key into a ticket, chat, repository or public example.

Create the server interface

Choose a private IPv4 tunnel subnet that does not overlap with networks you already use. This example uses 10.66.0.0/24 and WireGuard's standard UDP port 51820. Add an IPv6 tunnel prefix only if you have planned an IPv6 design; the IPv6 page explains the useful routed-prefix model.

[Interface]
# /etc/wireguard/wg0.conf
Address = 10.66.0.1/24
ListenPort = 51820
PrivateKey = <contents of /etc/wireguard/server.key>

# Add a [Peer] for each client below

Replace the placeholder with the private key locally, then protect the configuration. Do not use the example network or port blindly if either conflicts with your own design.

Create and connect the first client

Generate the client key pair on the client where possible. Assign this first client 10.66.0.2. Its public key goes on the server; the server public key and endpoint go in the client configuration.

# On the client, with umask 077
wg genkey | tee client.key | wg pubkey > client.pub

# Add this peer to /etc/wireguard/wg0.conf on the server
[Peer]
PublicKey = <contents of client.pub>
AllowedIPs = 10.66.0.2/32

[Interface]
# Client configuration
Address = 10.66.0.2/24
PrivateKey = <contents of client.key>

[Peer]
PublicKey = <contents of server.pub>
Endpoint = vpn.example.net:51820
AllowedIPs = 10.66.0.0/24
PersistentKeepalive = 25

Use your server's resolvable name or stable public address for Endpoint. PersistentKeepalive is helpful for a roaming phone or a client behind NAT; it keeps a return path open. Initially, limiting the client AllowedIPs to the VPN subnet is an easy way to test the tunnel before deciding whether any other networks should travel through it.

Bring it up and verify it

# On the server after adding the first peer
wg-quick up wg0
wg show wg0

# From the client, bring up its configuration, then test the tunnel address
ping 10.66.0.1

# On the server, look for a recent handshake and traffic counters
wg show wg0

A recent latest handshake and increasing transfer counters show that the peers can reach each other. If they do not, first check the endpoint name and port, the two public keys, the peer AllowedIPs, and the firewall rule that permits inbound UDP 51820.