privacy-warrior/wgzero

Zero overhead wireguard setup

WGZero

CLI based wireguard server manager. Tested on Debian Bullseye.

Features

• Plain IPv4 installation
• Multi interfaces support
• IPv6
  • NAT
  • Full routing
• Import & uninstall
• Easy backup

Requirements

Packages

wireguard curl qrencode iptables jq bsdmainutils

IPv6

If you need IPv6, please make sure you can access internet using ipv6 before proceeding.

There are 2 types of connection:

NAT

• Internal IPv6 communication uses ULA (Unique Local Address).
• Prioritize on using public IPv6 (shared with all clients) and fallback to IPv4 when not available.

see image

Full Routing

• Assign unique public IPv6 to each clients.
• You need to have an IPv6 address and a block of /64 IPv6 addresses.
  • IPv6 address should be assigned to main interface and /64 is reserved for wireguard
  • If you only get /64 from VPS provider, you need to split it into smaller blocks and install ndppd (see example)
  • If you don't have it, you can get free IPv6 from Tunnelbroker (see example)

see image

Installation

curl -o /usr/local/bin/wgzero https://raw.githubusercontent.com/finzzz/wgzero/master/wgzero
chmod +x /usr/local/bin/wgzero
wgzero install

Example Installation

• Plain IPv4
• NAT
• Full Routing
  • only has /64 block
  • Tunnerbroker

Backup and restore

Backup is simple, just save /etc/wireguard/<interface name>.conf. All of the data including clients are stored in that file. To restore, simply run wgzero import <interface name>.conf on new host.

Other Commands

wgzero install
wgzero uninstall <wg_interface>
wgzero import wg0.conf

# default wg0
wgzero list <wg_interface>
wgzero show clientname <wg_interface> 
wgzero qr clientname <wg_interface> 
wgzero enable clientname <wg_interface>
wgzero disable clientname <wg_interface> 
wgzero del clientname <wg_interface>

FAQ and Troubleshooting