WIUNIX ACADEMY
Set up a routed WireGuard site-to-site VPN on Ubuntu and Debian
Page 8 of 8. Review the earlier steps and prerequisites before continuing.
YOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
USE YOUR OWN VALUES
Configure this tutorial
Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.
Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.
Set values for my environment24 editable values
Optional controlled reboot, one gateway at a time
Only on the dedicated gateway during the planned interruption, with console ready and router routes already persistent. This disconnects sessions. Reconnect independently, then repeat both receiver tests before touching the other site.
sudo systemctl reboot
LET’S BUILD
Pause without deleting keys or configurations
On A/B from independent management, stop tunnel BEFORE the filter. Files/keys/backups remain. Rename only this tutorial sysctl file out of loading and restore the recorded 0/1 value. Do not apply all sysctls, flush rules, purge packages or delete data. Forwarding toggles can reset IPv4 defaults; compare retained sysctl baseline and reconcile actual site tuning, rather than replaying a whole dump. If another workload now depends on this state, resolve ownership before reversal. Remove only tutorial router routes through their native persistent manager too; temporary Linux equivalents follow.
sudo systemctl disable --now wg-quick@wg0.service
sudo systemctl disable --now academy-wg-filter.service
sudo bash -eu <<'REVERSE'
before=$(cat /etc/wireguard/forwarding.before)
case "$before" in 0|1) ;; *) echo 'Invalid baseline: STOP' >&2; exit 1;; esac
p=/etc/sysctl.d/70-academy-wireguard.conf
test ! -e "$p.disabled"
mv "$p" "$p.disabled"
sysctl -w "net.ipv4.ip_forward=$before"
REVERSE
Only tutorial tunnel/filter stop; baseline forwarding returns and recovery inputs remain.
Remove only A’s temporary test route
On Linux router A only if this exact route was added for this tutorial; remove its persistent counterpart with the owning manager.
sudo ip route del 10.20.20.0/24 via 10.10.10.2 dev lan0
Remove only B’s temporary test route
On Linux router B under the same exact ownership condition.
sudo ip route del 10.10.10.0/24 via 10.20.20.2 dev lan0
Operate the complete packet path
Monitor receiver probes, traffic, packet loss and interface errors together with handshake age. Silent idle peers are not automatically down; active interfaces are not automatically healthy. Add business ports explicitly at gateways AND hosts after approving source/destination/service. Key rotation needs coordinated peer changes and independent management; keep old keys only under your retention policy. Multi-site BGP, redundant paths and IPv6 require separate designs. Keep application authentication/TLS.
GO TO THE SOURCE
Official references
Each environment states how it was reviewed. A documentation review does not claim a hands-on test of every version.
KEEP LEARNING