{"id":1974,"date":"2025-10-19T15:27:10","date_gmt":"2025-10-19T18:57:10","guid":{"rendered":"https:\/\/blog.danjoannis.com\/?p=1974"},"modified":"2025-10-19T15:30:50","modified_gmt":"2025-10-19T19:00:50","slug":"problems-connecting-to-wireguard-vpn-using-ubuntu-24-client","status":"publish","type":"post","link":"https:\/\/blog.danjoannis.com\/?p=1974","title":{"rendered":"Problems Connecting to WireGuard VPN using Ubuntu 24 Client"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">I&#8230; can&#8217;t believe I have to write this post. In fact, I also can&#8217;t believe it took me to so long to get working. Generally, I wouldn&#8217;t consider myself stupid but today I have to wonder.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><a href=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/Screenshot-from-2025-10-19-14-16-08.png\"><img loading=\"lazy\" decoding=\"async\" width=\"656\" height=\"132\" src=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/Screenshot-from-2025-10-19-14-16-08.png\" alt=\"\" class=\"wp-image-1977\" srcset=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/Screenshot-from-2025-10-19-14-16-08.png 656w, https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/Screenshot-from-2025-10-19-14-16-08-300x60.png 300w\" sizes=\"auto, (max-width: 656px) 100vw, 656px\" \/><\/a><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">WireGuard is one of many protocols for VPN tunnels, and I&#8217;ve been using it for the past few years. That&#8217;s not to say it is the first VPN server I&#8217;ve worked with, oh no &#8211; there is a list:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>PPTP\/MS CHAP on DD-WRT (ew)<\/li>\n\n\n\n<li>L2TP\/IPsec with SoftEther\/pfSense<\/li>\n\n\n\n<li>SSLVPN with WatchGuard<\/li>\n\n\n\n<li>OpenVPN with SoftEther\/pfSense\/OPNsense<\/li>\n\n\n\n<li>WireGuard with OPNsense<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">While not a VPN newb, the experience using WireGuard seems variable on different platforms. The Windows WireGuard client is excellent. The Android client is even better, with the QR code automatic configuration.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So why am I having problems now? Well, recently I decided that fighting M$ is no longer worth it. After many failed attempts over the years, I&#8217;ve finally converted all my servers and daily-driver PCs to run some variant of Linux (\ud83d\udc4f slow clap).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With Ubuntu on my PC, I got to work configuring the system the way I need &#8211; which includes setting up my WireGuard VPN connection. This is where the rabbit hole began, and is why this write-up exists.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><a href=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/image.png\"><img loading=\"lazy\" decoding=\"async\" width=\"402\" height=\"281\" src=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/image.png\" alt=\"\" class=\"wp-image-1982\" srcset=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/image.png 402w, https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/image-300x210.png 300w\" sizes=\"auto, (max-width: 402px) 100vw, 402px\" \/><\/a><figcaption class=\"wp-element-caption\">It says connected, but it&#8217;s not!<\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Once it was configured and added, toggling on the VPN connection seemed to work, but no traffic flowed. Also, the server did not show the connection. <sub>Why are things always harder on Linux.<\/sub><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Problem<\/h2>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><a href=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/SystemProblem.png\"><img loading=\"lazy\" decoding=\"async\" width=\"466\" height=\"148\" src=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/SystemProblem.png\" alt=\"\" class=\"wp-image-1978\" srcset=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/SystemProblem.png 466w, https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/SystemProblem-300x95.png 300w\" sizes=\"auto, (max-width: 466px) 100vw, 466px\" \/><\/a><figcaption class=\"wp-element-caption\">I see this a lot.<\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Let&#8217;s not beat around the bush, the VPN configuration section under GNOME Settings has some flaws and bugs. <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>If you switch windows from the Peer settings modal, for example to copy the Public Key from your browser, the modal goes away and doesn&#8217;t save what you just entered.<\/li>\n\n\n\n<li>If you change the MTU or fwmark back to 0, GNOME Settings just crashes.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Working around the annoying copy-paste process for the Public Key, adding the WireGuard configuration wasn&#8217;t the problem. It was actually connecting afterwards.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><a href=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/Screenshot-from-2025-10-19-14-45-19.png\"><img loading=\"lazy\" decoding=\"async\" width=\"801\" height=\"190\" src=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/Screenshot-from-2025-10-19-14-45-19.png\" alt=\"\" class=\"wp-image-1979\" srcset=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/Screenshot-from-2025-10-19-14-45-19.png 801w, https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/Screenshot-from-2025-10-19-14-45-19-300x71.png 300w, https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/Screenshot-from-2025-10-19-14-45-19-768x182.png 768w\" sizes=\"auto, (max-width: 801px) 100vw, 801px\" \/><\/a><figcaption class=\"wp-element-caption\">Wow, real helpful. I guess it isn&#8217;t working?<\/figcaption><\/figure>\n<\/div>\n\n\n<h2 class=\"wp-block-heading\">LMGTFY<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You know I searched. There are <a href=\"https:\/\/askubuntu.com\/questions\/1520182\/how-to-configure-the-pre-installed-wireguard-client-on-ubuntu-24-04-via-network\">tons<\/a> <a href=\"https:\/\/serverspace.io\/support\/help\/how-to-install-wireguard-vpn-client-on-ubuntu-linux\/\">of<\/a> <a href=\"https:\/\/www.reddit.com\/r\/WireGuard\/comments\/ru6tvh\/connecting_to_wireguard_server_from_ubuntu\/\">guides<\/a> that make it seem <a href=\"https:\/\/markliversedge.blogspot.com\/2023\/09\/wireguard-setup-for-dummies.html\">easy<\/a>. And none of them hit the nail on the head for this issue (though that last one was where I had a eureka moment).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The logical search term &#8220;can&#8217;t connect ubuntu wireguard client&#8221; did not find the answer &#8211; so I&#8217;m writing this article hoping you searched for the same thing and it solves your problem.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">TL;DR<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Here is the solution that worked in my case.<\/p>\n\n\n\n<!--more-->\n\n\n\n<p class=\"wp-block-paragraph\">You may need to modify some things to suit your desired configuration. In my environment, I want the following:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>All traffic through VPN.<\/li>\n\n\n\n<li>DNS through VPN\/firewall.<\/li>\n\n\n\n<li>No IPv6.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">How to Configure WireGuard Client on Ubuntu 24<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>In OPNsense, go to the WireGuard Peer Generator.\n<ul class=\"wp-block-list\">\n<li>Fill in everything as needed for your new Ubuntu client.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>On the Ubuntu PC, open Settings -&gt; Network and click &#8220;+&#8221; under VPN.\n<ul class=\"wp-block-list\">\n<li>Select WireGuard.<\/li>\n\n\n\n<li>Configure as follows:<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>WireGuard tab<\/strong><\/h3>\n\n\n\n<ul id=\"block-d1fc9ad8-a0f4-4010-ad16-5a8fa9fe55d2\" class=\"wp-block-list\">\n<li>Enter Connection Name (ex. MyVPN).<\/li>\n\n\n\n<li>Enter Interface Name (ex. wg0).<\/li>\n\n\n\n<li>Copy and paste Private Key from Peer Generator.<\/li>\n\n\n\n<li>Enter Listen Port (ex. 44444, anything but the port used by your server which is default 51820).<\/li>\n\n\n\n<li>Copy the <em>server&#8217;s<\/em> Public Key from the [Peer] section of Config in the Peer Generator (important to do now).<\/li>\n\n\n\n<li>Click &#8220;+&#8221; under Peers\n<ul class=\"wp-block-list\">\n<li>Endpoint address: manually type it with port (ex. yourdomain.tld:port).<\/li>\n\n\n\n<li>Public key: paste the <em>server&#8217;s public key<\/em> you previously copied.<\/li>\n\n\n\n<li>Pre-shared key: if you have one, leave alone for now.<\/li>\n\n\n\n<li>Allowed IPs addresses: 0.0.0.0\/0<\/li>\n\n\n\n<li>Click Apply.<\/li>\n\n\n\n<li>If you have a Preshared Key:\n<ul class=\"wp-block-list\">\n<li>Copy it from Peer Generator.<\/li>\n\n\n\n<li>Edit the newly created peer.<\/li>\n\n\n\n<li>Paste it in the field.<\/li>\n\n\n\n<li>Click Apply.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><a href=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/vlcsnap-2025-10-19-15h42m55s965.png\"><img loading=\"lazy\" decoding=\"async\" width=\"774\" height=\"623\" src=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/vlcsnap-2025-10-19-15h42m55s965.png\" alt=\"\" class=\"wp-image-1998\" srcset=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/vlcsnap-2025-10-19-15h42m55s965.png 774w, https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/vlcsnap-2025-10-19-15h42m55s965-300x241.png 300w, https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/vlcsnap-2025-10-19-15h42m55s965-768x618.png 768w\" sizes=\"auto, (max-width: 774px) 100vw, 774px\" \/><\/a><\/figure>\n<\/div>\n\n\n<h3 class=\"wp-block-heading\"><strong>IPv4 tab<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>IPv4 Method: Manual<\/li>\n\n\n\n<li>Addresses:\n<ul class=\"wp-block-list\">\n<li>Address: &lt;static IP assigned to client&gt;<\/li>\n\n\n\n<li>Network: &lt;network mask (i.e. \/24 and not \/32)&gt;<\/li>\n\n\n\n<li>Gateway: &lt;blank&gt;<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>DNS: &lt;blank&gt;<\/li>\n\n\n\n<li>Routes: &lt;blank&gt;<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><a href=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/Screenshot-from-2025-10-19-15-55-54.png\"><img loading=\"lazy\" decoding=\"async\" width=\"774\" height=\"623\" src=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/Screenshot-from-2025-10-19-15-55-54.png\" alt=\"\" class=\"wp-image-2002\" srcset=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/Screenshot-from-2025-10-19-15-55-54.png 774w, https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/Screenshot-from-2025-10-19-15-55-54-300x241.png 300w, https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/Screenshot-from-2025-10-19-15-55-54-768x618.png 768w\" sizes=\"auto, (max-width: 774px) 100vw, 774px\" \/><\/a><\/figure>\n<\/div>\n\n\n<h3 class=\"wp-block-heading\"><strong>IPv6 tab<\/strong><\/h3>\n\n\n\n<ul id=\"block-bff4750f-4d39-40aa-b637-eff584e9a486\" class=\"wp-block-list\">\n<li>Disable (in my case)<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><a href=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/vlcsnap-2025-10-19-15h42m00s980.png\"><img loading=\"lazy\" decoding=\"async\" width=\"774\" height=\"623\" src=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/vlcsnap-2025-10-19-15h42m00s980.png\" alt=\"\" class=\"wp-image-2012\" srcset=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/vlcsnap-2025-10-19-15h42m00s980.png 774w, https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/vlcsnap-2025-10-19-15h42m00s980-300x241.png 300w, https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/vlcsnap-2025-10-19-15h42m00s980-768x618.png 768w\" sizes=\"auto, (max-width: 774px) 100vw, 774px\" \/><\/a><\/figure>\n<\/div>\n\n\n<h3 class=\"wp-block-heading\">Final Steps<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Click Add\/Apply to add the VPN connection on the Ubuntu client.<\/li>\n\n\n\n<li>Go back to the Peer Generator in OPNsense, Store the configuration, then click Apply.<\/li>\n\n\n\n<li><strong><em>Connect to the VPN<\/em><\/strong><em><strong>!<\/strong><\/em> \ud83c\udf89<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/Screenshot-from-2025-10-19-16-11-53.png\"><img loading=\"lazy\" decoding=\"async\" width=\"909\" height=\"29\" src=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/Screenshot-from-2025-10-19-16-11-53.png\" alt=\"\" class=\"wp-image-2007\" srcset=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/Screenshot-from-2025-10-19-16-11-53.png 909w, https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/Screenshot-from-2025-10-19-16-11-53-300x10.png 300w, https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/Screenshot-from-2025-10-19-16-11-53-768x25.png 768w\" sizes=\"auto, (max-width: 909px) 100vw, 909px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The trick is in the IPv4 tab. Most of the guides instruct you to fill in the the Interface address as &lt;IP&gt;\/32 as defined in the Peer Configuration, but I believe this prevents Ubuntu from reaching the default gateway. The subnet mask should match the VPN client network subnet (usually \/24).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As for Gateway, DNS, and routes, it seems these are automatically determined. When I manually specified these it would generally cause the VPN to not connect anymore. Yay.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Other Methods<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">There was one <a href=\"https:\/\/www.reddit.com\/r\/WireGuard\/comments\/ru6tvh\/connecting_to_wireguard_server_from_ubuntu\/\">method<\/a> which <em>did<\/em> work proposed by [ArtSchoolRejectedMe] on Reddit.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Install WireGuard (sudo apt install wireguard).<\/li>\n\n\n\n<li>Copy the config file from Peer Generator.<\/li>\n\n\n\n<li>On the Ubuntu client, create the config file:\n<ul class=\"wp-block-list\">\n<li>&#8220;sudo nano \/etc\/wireguard\/wg0.conf&#8221; <\/li>\n\n\n\n<li>Paste the configuration.<\/li>\n\n\n\n<li>Ctrl-X to save.<\/li>\n\n\n\n<li>Type Y to confirm and press Enter.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Start VPN using &#8220;sudo wg-quick up wg0&#8221;.<\/li>\n\n\n\n<li>Stop VPN using &#8220;sudo wg-quick down wg0&#8221;.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">This worked, and didn&#8217;t use GNOME Settings. But it also didn&#8217;t make the VPN appear in the VPN list, which means keeping the terminal handy to connect\/disconnect.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">2025, the year of the Linux desktop?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For me, it very well may be!<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><a href=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/image-4.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"802\" src=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/image-4-1024x802.png\" alt=\"\" class=\"wp-image-2010\" style=\"width:498px;height:auto\" srcset=\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/image-4-1024x802.png 1024w, https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/image-4-300x235.png 300w, https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/image-4-768x601.png 768w, https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2025\/10\/image-4.png 1386w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">It is time consuming chasing crap like this, no question. What simply works on Windows cannot be taken for granted on Linux, even in 2025. Which is wild, given most of these awesome FOSS projects are built in Linux to begin with.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I don&#8217;t understand it, but I am thankful for it. Without such hard working believers in FOSS, the world would be an even more vendor-locked and subscription-heavy place.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It could be worse, is what I&#8217;m saying. It could be Windows <s>10<\/s> <s>11<\/s> 365.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>I&#8230; can&#8217;t believe I have to write this post. In fact, I also can&#8217;t believe it took me to so long to get working. Generally, I wouldn&#8217;t consider myself stupid but today I have to wonder. WireGuard is one of many protocols for VPN tunnels, and I&#8217;ve been using it for the past few years. [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":1978,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,5,285,9],"tags":[],"class_list":["post-1974","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-computers","category-life","category-networking","category-software"],"_links":{"self":[{"href":"https:\/\/blog.danjoannis.com\/index.php?rest_route=\/wp\/v2\/posts\/1974","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.danjoannis.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.danjoannis.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.danjoannis.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.danjoannis.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1974"}],"version-history":[{"count":19,"href":"https:\/\/blog.danjoannis.com\/index.php?rest_route=\/wp\/v2\/posts\/1974\/revisions"}],"predecessor-version":[{"id":2016,"href":"https:\/\/blog.danjoannis.com\/index.php?rest_route=\/wp\/v2\/posts\/1974\/revisions\/2016"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.danjoannis.com\/index.php?rest_route=\/wp\/v2\/media\/1978"}],"wp:attachment":[{"href":"https:\/\/blog.danjoannis.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1974"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.danjoannis.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1974"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.danjoannis.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1974"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}