WIUNIX ACADEMY
Set up a routed WireGuard site-to-site VPN on Ubuntu and Debian
Page 7 of 8. Review the earlier steps and prerequisites before continuing.
YOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
USE YOUR OWN VALUES
Configure this tutorial
Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.
Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.
Set values for my environment24 editable values
Inspect MTU and edit only after measurement
On A/B. If measurement establishes a smaller safe MTU, edit both protected configs. The next 1380 setting is an example ONLY, never a universal default.
ip link show wg0
sudo nano /etc/wireguard/wg0.conf
Optional measured Interface setting
FILE CONTENT under existing Interface ONLY if 1380 was appropriate in your measured path.
MTU = 1380
Planned tunnel-only restart
On A/B from independent management during an approved interruption. Repeat handshake and both receiver tests. Endpoint names, if used, are not continuously re-resolved by this recipe; controlled restart resolves them again.
sudo systemctl restart wg-quick@wg0.service
sudo wg show wg0 latest-handshakes
LET’S BUILD
Check a protected configuration backup
On A/B after data tests. Archive contains PRIVATE keys: retain root-only and encrypted approved off-host, never Git/public links. It contains tutorial inputs only; export persistent router routes separately with their owner. Read/byte comparison is not a recovery rehearsal by itself.
sudo bash -eu <<'BACKUP'
umask 077
install -d -m 0700 /root/academy-backups
b=$(mktemp -d /root/academy-backups/wireguard-XXXXXXXX)
tar -C / -cpf "$b/config.tar" etc/wireguard etc/sysctl.d/70-academy-wireguard.conf etc/systemd/system/academy-wg-filter.service etc/systemd/system/wg-quick@wg0.service.d/20-academy-filter.conf
tar -tf "$b/config.tar" >/dev/null
tar -C / -df "$b/config.tar"
(cd "$b" && sha256sum config.tar > config.tar.sha256)
printf 'Protected backup: %s\n' "$b"
BACKUP
Readable matching archive/checksum exist without displaying secrets.
LET’S BUILD
Rehearse extraction before relying on recovery
On an isolated recovery VM with no production LAN/WAN connection and compatible tools/kernel. Securely transfer the protected archive first and replace the exact backup directory. Extract into a NEW scratch root, never a live gateway. Verify restored public identity against the separately retained record. Do not activate copied private identities on connected networks while originals live. Before destructive retirement, rehearse interface startup, routing and both LAN receiver checks in a fully isolated replica topology using these restored inputs; abort on any failure. This panel proves extraction/identity, not full routed disaster recovery.
sudo bash -eu <<'RESTORE'
umask 077
backup=/root/academy-backups/wireguard-REPLACE_EXACT_DIRECTORY
cd "$backup"
sha256sum -c config.tar.sha256
restore=$(mktemp -d /root/wireguard-restore-XXXXXXXX)
tar -xpf config.tar -C "$restore"
for p in etc/wireguard/private.key etc/wireguard/wg0.conf etc/wireguard/academy-filter.nft; do
cmp "$restore/$p" <(tar -xOf config.tar "$p")
done
test "$(stat -c %a "$restore/etc/wireguard/private.key")" = 600
wg pubkey < "$restore/etc/wireguard/private.key" > "$restore/public.check"
cmp "$restore/public.check" "$restore/etc/wireguard/public.key"
printf 'Restored protected tree: %s\n' "$restore"
RESTORE
Archive checksum, extracted bytes, private-key permissions and public identity match; no network was activated.
Prove persistence in a maintenance window
With independent consoles ready and router routes saved through their native manager, schedule controlled reboots one device at a time. Repeat second-session management, active filter/tunnel, fresh handshake and exact receiver data in both LAN directions. Systemd enable is not reboot evidence. Stop scratch receivers with Ctrl+C in their own terminals; keep marker directories for later normal housekeeping.