[opensourcedex]

wireguard-install is a free, open source networking & connectivity project written in Shell and released under MIT. It has 2,663 GitHub stars, 455 forks and 0 open issues, and was last pushed 25 hours ago. On this registry it ranks #24 of 26 tracked projects in Networking & Connectivity, with 5 head-to-head comparisons available.

What is wireguard-install?

wireguard-install is an MIT-licensed Shell installer for Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS, Fedora, openSUSE and Raspberry Pi OS that stands up and manages a WireGuard VPN server on a Linux machine in a few minutes, and it is aimed at self-hosters, system administrators and small teams who want their own VPN endpoint — typically on a cloud server, virtual private server or dedicated server — without configuring WireGuard by hand.

What it is

The project is a single Bash script, wireguard-install.sh, distributed for download as wireguard.sh from https://get.vpnsetup.net/wg and also reachable from its GitHub and GitLab raw URLs. It belongs to the same author's family of self-hosted VPN installers, which includes openvpn-install, setup-ipsec-vpn and headscale-install, alongside containerised counterparts such as docker-wireguard, docker-openvpn, docker-ipsec-vpn-server and docker-headscale. It is written in Shell, licensed under MIT, and carries 2,663 stars and 455 forks with no open issues at the time of writing.

The concrete problem it solves is the manual assembly of a WireGuard server on a fresh Linux host. Rather than installing packages, generating keys, writing interface and peer configuration and then producing a working client profile for every device by hand, the script performs the setup itself and emits ready-to-import VPN profiles for Windows, macOS, iOS and Android, together with QR codes for mobile devices. It also allows WireGuard users to be managed afterwards, so a peer can be added or removed without rebuilding the server configuration.

Key capabilities

  • Fully automated setup via sudo bash wireguard.sh --auto, which needs no user input at all.
  • Interactive setup via sudo bash wireguard.sh, where the server's DNS name, UDP port, the DNS server used by VPN clients and the name of the first client can all be chosen.
  • Generation of VPN profiles that auto-configure Windows, macOS, iOS and Android devices.
  • QR code output so a phone or tablet can be enrolled without transferring a configuration file.
  • Built-in management of WireGuard VPN users after the initial installation.
  • Optimisation of sysctl settings for improved VPN performance.
  • Dual-stack IPv4 and IPv6 support for VPN clients, with the peer-to-peer and encryption topics reflected in the project's topic list.

Who uses it and how

  • Administrators running a cloud server, VPS or dedicated server who want a private VPN endpoint on hardware they already pay for.
  • Operators of hosts behind an external firewall, such as AWS EC2 security groups or Google Cloud firewalls, who open UDP port 51820 — or the port chosen during interactive setup — for the VPN traffic.
  • Raspberry Pi OS users, since that distribution is explicitly supported alongside the mainstream server distributions.
  • Teams consolidating remote access on one machine by installing OpenVPN, IPsec VPN or Headscale on the same server with the sibling scripts.
  • Users who prefer containers over a host install, who are pointed to docker-wireguard instead.

Getting started

Download the script with wget -O wireguard.sh https://get.vpnsetup.net/wg (or curl -fL -o wireguard.sh https://get.vpnsetup.net/wg), then run sudo bash wireguard.sh --auto for default options or sudo bash wireguard.sh for the interactive path.

How it compares

No list of paid products is given, so the relevant comparison is with the sibling projects named in the README: openvpn-install and setup-ipsec-vpn cover the OpenVPN and IPsec protocols, headscale-install covers Headscale, and docker-wireguard offers the same WireGuard protocol in a container rather than as a host script. All of these sit in the same MIT-licensed, self-hosted family, so the choice between them is about protocol and deployment shape rather than licence or cost.

When to use it — and when not to

A self-hoster supplies the Linux host, runs the script and keeps the relevant UDP port open on any external firewall; the README describes no database, SMTP service or object storage that must be operated alongside it. Anyone who needs a hosted service, a graphical control panel or a web-based user interface should not pick this, because management happens through the script itself. The documentation provided is installation-focused and thin on operational detail, the supported distributions are only those listed, and container deployments require a separate repository, so the project is best suited to administrators who are comfortable on a Linux shell.

project readme (upstream, from github) — read inline

English | 简体中文 | 繁體中文 | Русский | Video en Español

WireGuard VPN Server Auto Setup Script

Build Status GitHub Stars License: MIT

WireGuard VPN server installer for Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS, Fedora, openSUSE and Raspberry Pi OS.

This script will let you set up your own VPN server in just a few minutes, even if you haven't used WireGuard before. WireGuard is a fast and modern VPN designed with the goals of ease of use and high performance.

Features:

  • Fully automated WireGuard VPN server setup, no user input needed
  • Supports interactive install using custom options
  • Generates VPN profiles to auto-configure Windows, macOS, iOS and Android devices
  • Generates QR codes for easy mobile device setup
  • Supports managing WireGuard VPN users
  • Optimizes sysctl settings for improved VPN performance
  • Dual-stack IPv4 and IPv6 support for VPN clients

Also available:

📘 Interested in self-hosted AI? The Self-Hosted AI Builder’s Guide is a practical guide to building, securing, and operating your own private AI stack.

Installation

First, download the script on your Linux server*:

wget -O wireguard.sh https://get.vpnsetup.net/wg

* A cloud server, virtual private server (VPS) or dedicated server.

Option 1: Auto install WireGuard using default options.

sudo bash wireguard.sh --auto
See the script in action (terminal recording).

Note: This recording is for demo purposes only.

Tip: Optionally install OpenVPN, IPsec VPN and/or Headscale on the same server.

For servers with an external firewall (e.g. EC2/GCE), open UDP port 51820 for the VPN.

Option 2: Interactive install using custom options.

sudo bash wireguard.sh

You can customize the following options: VPN server's DNS name, UDP port, DNS server for VPN clients and name of the first client.

For servers with an external firewall, open your selected UDP port for the VPN.

Click here if you are unable to download.

You may also use curl to download:

curl -fL -o wireguard.sh https://get.vpnsetup.net/wg

Then follow the instructions above to install.

Alternative setup URLs:

https://github.com/hwdsl2/wireguard-install/raw/master/wireguard-install.sh
https://gitlab.com/hwdsl2/wireguard-install/-/raw/master/wireguard-install.sh

If you are unable to download, open wireguard-install.sh, then click the Raw button on the right. Press Ctrl/Cmd+A to select all, Ctrl/Cmd+C to copy, then paste into your favorite editor.

Advanced: Auto install using custom options.

Advanced users can auto install WireGuard using custom options, by specifying command-line options when running the script. For more details, see the next section "view usage information for the WireGuard script".

Alternatively, you may provide a Bash "here document" as input to the setup script. This method can also be used to provide input to manage users after install.

First, install WireGuard interactively using custom options, and write down all your inputs to the script.

sudo bash wireguard.sh

If you need to remove WireGuard, run the script again and select the appropriate option.

Next, create the custom install command using your inputs. Example:

sudo bash wireguard.sh <<ANSWERS
n
51820
client
2
y
ANSWERS

Note: The install options may change in future versions of the script.

View usage information for the WireGuard script. 
Usage: bash wireguard.sh [options]

Options:

  --addclient [client name]      add a new client
  --dns1 [DNS server IP]         primary DNS server for new client (optional, default: Google Public DNS)
  --dns2 [DNS server IP]         secondary DNS server for new client (optional)
  --listclients                  list the names of existing clients
  --removeclient [client name]   remove an existing client
  --showclientqr [client name]   show QR code for an existing client
  --uninstall                    remove WireGuard and delete all configuration
  -y, --yes                      assume "yes" as answer to prompts when removing a client or removing WireGuard
  -h, --help                     show this help message and exit

Install options (optional):

  --auto                         auto install WireGuard using default or custom options
  --serveraddr [DNS name or IP]  server address, must be a fully qualified domain name (FQDN) or an IPv4 address
  --port [number]                port for WireGuard (1-65535, default: 51820)
  --clientname [client name]     name for the first WireGuard client (default: client)
  --dns1 [DNS server IP]         primary DNS server for first client (default: Google Public DNS)
  --dns2 [DNS server IP]         secondary DNS server for first client

To customize options, you may also run this script without arguments.

Community

Next steps

After setup, you can run the script again to manage users or uninstall WireGuard.

Get your computer or device to use the VPN. Please refer to:

Configure WireGuard VPN Clients

Read 📘 VPN book to access extra content.

Enjoy your very own VPN! :sparkles::tada::rocket::sparkles:

Credits

This script is based on the great work of Nyr and contributors, with enhancements and changes for compatibility with the Setup IPsec VPN project.

List of enhancements over Nyr/wireguard-install.
  • Improved compatibility with Setup IPsec VPN
  • Improved script reliability, user input and output
  • Supports auto install using default or custom options
  • Supports using a DNS name as server address
  • Added support for openSUSE Linux
  • Supports listing existing VPN clients
  • Supports showing QR code for a client
  • Supports custom DNS server(s) for VPN clients
  • Supports command-line options for managing VPN clients
  • Optimizes sysctl settings for improved VPN performance
  • Improved creation of client config files when using sudo

...and more!

License

MIT

Frequently asked questions

Is wireguard-install free to use?

wireguard-install is open source under the MIT licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does wireguard-install do?

WireGuard VPN server installer for Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS, Fedora, openSUSE and Raspberry Pi OS. Includes interactive setup and client m

What is wireguard-install written in?

wireguard-install is primarily written in Shell. Its source is publicly available at https://github.com/hwdsl2/wireguard-install, and it has 2,663 GitHub stars.