How to Set Up WireGuard on Ubuntu 24.04 LTS and Linux Mint: Step-by-Step Guide

Introduction

In this step-by-step guide, you'll learn how to set up WireGuard on Ubuntu 24.04 LTS and Linux Mint from scratch, using two methods: the NetworkManager graphical interface and the command line (CLI). We’ll show you how to quickly import a ready-made config, manually create a profile, enable auto-start, configure DNS and routing (full tunnel or split tunnel), as well as how to diagnose and fix common issues. By the end, you’ll have a reliable and predictable VPN connection that you can toggle on and off with a single click and that automatically starts with your system.

This guide is perfect for Linux beginners who want straightforward instructions without unnecessary theory, but with clear explanations. Throughout, you’ll also find advanced tips like setting up a killswitch, fine-tuning MTU, working with multiple peers, and scripting with nmcli.

What do you need to know beforehand? Nothing critical: just basic system skills, how to enter commands in the terminal, and where to find network settings. We'll break everything down step-by-step. Allow 60–90 minutes to complete the entire setup, including testing and fixing any minor mismatches.

The result: a working WireGuard connection managed via NetworkManager (an "On/Off" toggle in your system tray or Settings), predictable routing, leak-proof DNS, auto-start at OS boot, and a clear action plan if anything goes wrong.

Preliminary Preparation

Before you start, make sure you have everything you need. We’ve listed the minimum requirements and explained why they’re necessary.

Required Tools and Access

• Access to a system running Ubuntu 24.04 LTS (Desktop) or Linux Mint (latest version based on Ubuntu 24.04). This can be a physical PC or a virtual machine.
• Administrator rights (sudo). You'll need these to install packages and change network settings.
• WireGuard VPN server connection details: either a ready .conf config file or a set of parameters including the server's public key, server address and port, your private key, allowed networks (AllowedIPs), interface address (Address), and optionally DNS.

System Requirements

• Linux kernel 5.6+ (already included in Ubuntu 24.04 and recent Linux Mint versions).
• NetworkManager version 1.40+ with native WireGuard support (included by default in Ubuntu 24.04 desktop builds and Mint based on it).
• Packages wireguard-tools (for key generation and diagnostics) and nmcli (part of NetworkManager) for CLI usage.

What to Install Before You Start

1. Open a terminal.
2. Update package indexes: sudo apt update
3. Install necessary tools: sudo apt install -y network-manager wireguard wireguard-tools
4. Check NetworkManager version: nmcli -v. It should be 1.40 or newer. If older, upgrade: sudo apt upgrade -y and reboot: sudo reboot.
5. Ensure NetworkManager is active: systemctl status NetworkManager. Status should be active (running).

Creating Backups

If you plan to replace existing VPN profiles or modify network settings, back them up first:

• Export NetworkManager profiles: nmcli connection export "connection-name" ~/backup-connection-name.nmconnection
• Save existing WireGuard configs: if you have files in /etc/wireguard or ~/.config/wireguard, copy them to a safe location: cp -a /etc/wireguard ~/wg-backup

⚠️ Warning: Pause or close critical network tasks during setup (remote sessions, active downloads), so sudden route changes don’t disrupt them.

Basic Concepts

Before diving into setup, let's explain some key terms simply. This helps you understand what each parameter does and what you check during troubleshooting.

• WireGuard Interface – a virtual network interface in your system (usually wg0, but you can name it anything). All encrypted traffic flows through it.
• Keys – WireGuard uses a private key on the client side and a public key on the server side (and vice versa). Peers recognize each other by public keys; the private key stays secret.
• Peer – the remote side of the tunnel. On the client, the peer is usually the server.
• AllowedIPs – networks that should route through the tunnel. Setting 0.0.0.0/0, ::/0 sends all traffic through VPN (full tunnel). Specifying only certain subnets creates a split tunnel.
• Endpoint – address and port of the remote WireGuard server.
• DNS – domain name servers the system uses inside the VPN. For full tunnel setups, typically you use the VPN provider’s DNS to prevent leaks.
• MTU – maximum packet size. Sometimes lowering MTU (e.g., to 1420 or 1280) helps avoid fragmentation and instability.
• PersistentKeepalive – interval to send "empty" packets to keep the connection alive behind NAT, commonly set to 25 seconds.

Tip: If you’re unsure about values, start by importing a ready-made config file. You can test it immediately and then understand which fields control what to adjust manually.

Step 1: Installing and Verifying Your Environment

Goal

After this step, you’ll confirm that all necessary packages are installed, NetworkManager supports WireGuard, and essential network services are running correctly.

Step-by-Step Instructions

1. Open terminal with Ctrl+Alt+T.
2. Update package list: sudo apt update
3. Install packages: sudo apt install -y network-manager wireguard wireguard-tools
4. Check NM version: nmcli -v. It should display nmcli tool, version 1.44.x or newer.
5. Confirm the service is active: systemctl is-active NetworkManager. Expected output: active.
6. Verify presence of wg tool: wg --version. It should show wireguard-tools version.
7. Find the name of your active internet connection: nmcli connection show --active. Note the interface name (e.g., "Wired connection 1" or "Home Wi-Fi").

⚠️ Warning: If you have other network managers installed simultaneously, disable them. Running multiple network management tools can cause route conflicts.

Tip: If you upgraded NetworkManager or kernel, reboot after: sudo reboot. This prevents hung service states.

Expected Outcome

Packages are installed, nmcli and wg commands available, and NetworkManager is active. You're ready to configure your WireGuard profile.

✅ Verification: Run nmcli general status — STATE and CONNECTIVITY should indicate you are online. The wg command should run without errors.

Common Issues and Fixes

• Issue: nmcli command not found. Cause: NetworkManager not installed. Fix: sudo apt install -y network-manager.
• Issue: wg command not found. Cause: wireguard-tools missing. Fix: sudo apt install -y wireguard-tools.
• Issue: NetworkManager fails to start. Cause: conflicting network daemon. Fix: disable or remove alternative managers and ensure standard Desktop config is used.

Step 2: Preparing Configuration and Keys

Goal

Get a ready .conf file to import or generate your own keys and config. By the end, you’ll have all data to enter into GUI or CLI.

Option A: Using a Ready Configuration

1. Copy your WireGuard config file (e.g., wg0.conf) to your home directory. For tidiness, use ~/.config/wireguard.
2. Check file permissions: chmod 600 ~/.config/wireguard/wg0.conf. Config may contain private keys—protect it carefully.
3. Open and review: cat ~/.config/wireguard/wg0.conf. Confirm it contains [Interface] and [Peer] sections.

Option B: Creating Keys and Config Manually

1. Create working directory: mkdir -p ~/.config/wireguard && cd ~/.config/wireguard
2. Set secure mask: umask 077 to restrict file permissions.
3. Generate private and public keys: wg genkey | tee client_private.key | wg pubkey > client_public.key
4. Keep keys safe. Don’t share your private key. Send public key to server admin to add your client.
5. Prepare values: local interface address (e.g., 10.14.0.2/32), server address and port (e.g., 203.0.113.10:51820), server public key, AllowedIPs (0.0.0.0/0, ::/0 for full tunnel or chosen subnets for split tunnel), DNS (e.g., 10.14.0.1).
6. Create config file: nano wg0.conf and enter structure like:
   [Interface]
   Address = 10.14.0.2/32, fd42:42:42::2/128
   PrivateKey = INSERT_PRIVATE_KEY
   DNS = 10.14.0.1
   
   [Peer]
   PublicKey = INSERT_SERVER_PUBLIC_KEY
   AllowedIPs = 0.0.0.0/0, ::/0
   Endpoint = 203.0.113.10:51820
   PersistentKeepalive = 25
7. Save and exit editor. Set file permissions: chmod 600 wg0.conf.

Tip: If you control the server, add the client’s public key onto the server config and assign a free IP from its subnet. Otherwise, the server won’t recognize the client and the handshake won’t succeed.

Expected Outcome

You have a wg0.conf file ready to import or a set of keys and values to manually enter into NetworkManager or nmcli.

✅ Verification: Verify wg0.conf opens and contains proper sections; the private key looks like a long base64 string. Running ls -l shows permissions as -rw------- on the file.

Common Issues and Fixes

• Issue: server public key missing. Cause: no data from admin. Fix: ask for PublicKey and Endpoint.
• Issue: don’t know your interface address. Cause: no addressing plan. Fix: use address from ready config or ask admin.
• Issue: client and server subnets don’t match. Cause: address conflict. Fix: check Address and subnet settings on both sides.

Step 3: Configuration via NetworkManager on Ubuntu 24.04 (GNOME)

Goal

Create and activate a WireGuard VPN connection using Ubuntu 24.04’s GUI for easy one-click control.

Step-by-Step (Importing a Ready File)

1. Open "Settings" (gear icon in dock or via system menu).
2. Go to the "Network" section.
3. Under "VPN", click "+" (Add VPN).
4. Select "Import from file…".
5. Browse to your wg0.conf and click "Open".
6. An editable profile window appears. Check the name (e.g., "WireGuard wg0"), addresses, keys, AllowedIPs, and Endpoint; modify if needed.
7. Click "Save".
8. The VPN profile appears in the list. Enable it by toggling the switch next to its name.

Step-by-Step (Manual Setup Without File)

1. Open “Settings” → “Network” → “VPN” → “+.”
2. Choose “WireGuard” (manual creation, not import).
3. In “Connection Name,” enter a clear name, like “WG Home.”
4. For “Interface Name,” specify wg0 or leave default.
5. Paste your client private key in “Private Key.” If missing, generate it (some GNOME builds support this), then export the public key for the server.
6. Enter “Addresses” (e.g., 10.14.0.2/32 and, if needed, fd42:42:42::2/128). Always include subnet mask.
7. Add tunnel DNS (e.g., 10.14.0.1) in the “DNS” field to prevent leaks.
8. Under “Peers,” click “Add Peer.” Enter server public key, Endpoint (e.g., 203.0.113.10:51820), AllowedIPs. For full tunnel use 0.0.0.0/0, ::/0; for split tunnel, just list required subnets. Set “Persistent Keepalive” to 25 if behind NAT.
9. Click “Save.”
10. Activate the new VPN profile by toggling it in the “VPN” section or via network tray menu.

Tip: If you lose local network access (e.g., router) after enabling VPN unexpectedly, check if full tunnel (0.0.0.0/0) is on. To keep local network accessible, use split tunnel and whitelist local subnets.

⚠️ Warning: Avoid running wg-quick and NetworkManager simultaneously on the same interface (e.g., wg0). This causes conflicts and unpredictable routing.

Expected Outcome

In “Network” → “VPN,” your WireGuard profile appears with an on/off toggle controlling the secure tunnel.

✅ Verification: After enabling, run wg show in terminal. You should see your wg0 interface, server public key as a peer, and traffic stats. nmcli connection show --active lists your active VPN connection.

Common Issues and Fixes

• Issue: WireGuard option missing in VPN setup wizard. Cause: outdated NetworkManager or desktop environment. Fix: update system, ensure you’re using standard Desktop with NM support, relaunch “Settings.”
• Issue: connection shows as connected but no traffic. Cause: incorrect AllowedIPs or DNS. Fix: verify routing (full vs split tunnel), set correct tunnel DNS.
• Issue: frequent disconnects. Cause: NAT or firewall interference. Fix: set PersistentKeepalive=25.

Step 4: Configuration via NetworkManager on Linux Mint (Cinnamon)

Goal

Create and activate a WireGuard profile in Linux Mint using standard Cinnamon network settings and NM connection editor.

Step-by-Step (Using “Network Connections”)

1. Open the Start menu in Linux Mint.
2. Go to “Settings” → “Network” or launch “Network Connections” (nm-connection-editor). Alternatively, click the network tray icon → “Network Settings” → “VPN.”
3. In the “Network Connections” window, click “+” (Add) at the bottom.
4. Select “WireGuard” from the list of types, or “Import from file…” if you have a ready wg0.conf.
5. If importing: select the file, verify fields, save.
6. If manually configuring: enter connection name (e.g., “WG Mint”), interface name (wg0), paste private key, fill in “Addresses,” “DNS” (e.g., 10.14.0.1), then add a “Peer” (server’s public key, Endpoint, AllowedIPs, PersistentKeepalive).
7. Click “Save” and close the window.
8. Activate the connection via network tray icon, selecting your WireGuard profile and clicking it.

Tip: When entering the private key manually, paste it in a text editor first to check for typos or extra characters, then copy it into the field.

Expected Outcome

Your WireGuard profile appears in network connections and can be enabled from the tray or editor.

✅ Verification: Open terminal and run ip addr show wg0. The wg0 interface should show your assigned IP (e.g., 10.14.0.2/32). Running wg show after a ping shows peers and traffic stats.

Common Issues and Fixes

• Issue: WireGuard type missing. Cause: outdated nm-connection-editor or no WireGuard support. Fix: upgrade system, install wireguard-tools, restart network connections editor.
• Issue: connection doesn’t appear in tray. Cause: profile not saved or NetworkManager disabled. Fix: restart NM: sudo systemctl restart NetworkManager and try activating again.

Step 5: Setup via CLI (nmcli): Import or Manual Creation

Goal

Learn to perform the same setup without GUI: import a config or create a profile from scratch using nmcli. Useful for automation and servers, but also great for desktop users.

Importing a Ready .conf

1. Ensure the config file exists at ~/.config/wireguard/wg0.conf with correct permissions (chmod 600).
2. Import it into NM: nmcli connection import type wireguard file ~/.config/wireguard/wg0.conf
3. Check profile presence: nmcli connection show | grep wireguard or filter by name.
4. Activate: nmcli connection up "wg0" or the exact NM-assigned name.

Manual Profile Creation

1. Create profile: nmcli connection add type wireguard con-name wg-home ifname wg0 ipv4.method manual ipv6.method ignore
2. Set addresses: nmcli connection modify wg-home ipv4.addresses 10.14.0.2/32. For IPv6: nmcli connection modify wg-home ipv6.method manual ipv6.addresses fd42:42:42::2/128
3. Set private key: nmcli connection modify wg-home wireguard.private-key "YOUR_PRIVATE_KEY"
4. Optional MTU: nmcli connection modify wg-home 802-3-ethernet.mtu 1420 or wireguard.mtu if your NM version supports it
5. For full tunnel DNS: nmcli connection modify wg-home ipv4.dns 10.14.0.1 ipv4.ignore-auto-dns yes
6. Add peer: nmcli connection modify wg-home +wireguard-peer.public-key "SERVER_PUBLIC_KEY" +wireguard-peer.endpoint "203.0.113.10:51820" +wireguard-peer.allowed-ips "0.0.0.0/0,::/0" wireguard-peer.persistent-keepalive 25
7. Activate: nmcli connection up wg-home

Split Tunnel via nmcli

1. Change peer AllowedIPs: nmcli connection modify wg-home wireguard-peer.allowed-ips "10.14.0.0/24,192.168.50.0/24"
2. Prevent default routing through VPN: nmcli connection modify wg-home ipv4.never-default yes
3. For local DNS, either don’t specify ipv4.dns or configure split-DNS per domain using NM and systemd-resolved features. Usually, leaving DNS unchanged works fine.
4. Apply changes: nmcli connection down wg-home && nmcli connection up wg-home

Tip: To view all profile settings and confirm, use: nmcli connection show wg-home. To check the active interface status: nmcli device show wg0.

Expected Outcome

Your WireGuard profile is created, imported, or configured manually, and activates successfully with nmcli, showing among active connections.

✅ Verification: Run wg show and ip route. For full tunnel, default route points through wg0. For split tunnel, only listed networks appear. nmcli connection show --active displays your profile.

Common Issues and Fixes

• Issue: nmcli errors modifying peer. Cause: typo in parameter keys. Fix: check wireguard-peer.* prefixes and use + for adding a new peer.
• Issue: connection comes up but no traffic. Cause: missing routes or DNS. Fix: set AllowedIPs 0.0.0.0/0, ::/0 and tunnel DNS for full tunnel.
• Issue: cannot activate profile. Cause: interface busy with wg-quick. Fix: run sudo wg-quick down wg0 and use only NetworkManager.

Step 6: DNS, Routing, and Choosing Between Full and Split Tunnel

Goal

Ensure traffic flows correctly (only what should go through VPN does), and DNS queries don’t leak outside the tunnel.

GUI Configuration Steps

1. Open your WireGuard profile in “Settings” → “Network” → “VPN” (Ubuntu) or “Network Connections” (Mint).
2. For full tunnel, make sure AllowedIPs are 0.0.0.0/0, ::/0 on the peer. Add tunnel DNS (e.g., 10.14.0.1) in the interface DNS field.
3. For split tunnel, list only needed subnets in AllowedIPs (e.g., 10.14.0.0/24). In profile settings, enable “Do not use by default” for IPv4 (equivalent to ipv4.never-default yes) if available; otherwise, NM usually manages this automatically via AllowedIPs.
4. Save and reactivate the connection.

CLI Configuration Steps

1. Full tunnel: nmcli connection modify wg-home wireguard-peer.allowed-ips "0.0.0.0/0,::/0" ipv4.dns 10.14.0.1 ipv4.ignore-auto-dns yes
2. Split tunnel: nmcli connection modify wg-home wireguard-peer.allowed-ips "10.14.0.0/24" ipv4.never-default yes
3. Apply changes: nmcli connection down wg-home && nmcli connection up wg-home

Tip: If websites load slowly or connection is unstable, try lowering MTU to 1420 or 1280. In GUI, find MTU under advanced interface settings; in CLI: nmcli connection modify wg-home 802-3-ethernet.mtu 1420 and reactivate the profile.

Expected Outcome

Routes match your chosen setup: full tunnel directs all traffic through VPN or split tunnel limits it to specific networks. DNS queries resolve predictably without leaks.

✅ Verification: Run ip route to verify default route points to wg0 for full tunnel. Check DNS with resolvectl status — tunnel DNS servers should appear. Ping an internal VPN address (e.g., 10.14.0.1), it should respond.

Common Issues and Fixes

• Issue: unstable name resolution. Cause: DNS conflicts between interfaces. Fix: set ipv4.ignore-auto-dns yes and specify tunnel DNS explicitly.
• Issue: some resources unreachable on full tunnel. Cause: firewall blocks outgoing traffic without proper rules. Fix: temporarily disable third-party firewalls or allow traffic through wg0 and to Endpoint.

Step 7: Auto-Start, Killswitch, and Stability

Goal

Ensure VPN starts automatically at boot, and your traffic doesn’t leak outside if the tunnel drops unexpectedly.

Auto-Start via NetworkManager

1. In GUI, open your WireGuard profile.
2. Enable “Connect automatically on startup” (sometimes called “Autoconnect”).
3. In CLI: nmcli connection modify wg-home connection.autoconnect yes

Killswitch with UFW (Basic Example)

1. Enable UFW if needed and not already enabled: sudo ufw enable
2. Set default deny for outgoing: sudo ufw default deny outgoing
3. Allow outgoing to WireGuard server (e.g., 203.0.113.10 port 51820 UDP): sudo ufw allow out to 203.0.113.10 port 51820 proto udp
4. Allow outgoing on wg0 interface: sudo ufw allow out on wg0
5. If doing split tunnel, allow local networks outside VPN as needed: sudo ufw allow out to 192.168.0.0/16
6. Check status: sudo ufw status verbose

⚠️ Warning: Misconfiguring your firewall may block internet or SSH access. If working remotely, test these rules in a separate session and be prepared to revert them.

Reliability and Resilience

• Set PersistentKeepalive=25 on the peer if the client is behind NAT.
• Lower MTU to stable values if you notice fragmentation or packet loss.
• Enable auto-reconnect if needed: NetworkManager can restore the profile after disconnects, but you can strengthen it with systemd hooks or nm-dispatcher scripts.

Tip: Store backups of your profile and keys on external storage or in a secure secrets manager for quick recovery in emergencies.

Expected Outcome

Your VPN starts automatically, and if the tunnel fails, traffic won’t leak outside if killswitch is enabled.

✅ Verification: Reboot your system. After login, run nmcli connection show --active — the WireGuard profile should be active. Disable the VPN and confirm that outgoing traffic is blocked when killswitch is on.

Common Issues and Fixes

• Issue: UFW blocks everything. Cause: overly strict rules. Fix: temporarily allow all outgoing: sudo ufw default allow outgoing and restart NM.
• Issue: auto-start doesn’t work. Cause: profile conflicts or network delays. Fix: enable “Wait for Network” in services, add delay via systemd or nm-dispatcher script.

Step 8: Quick Start by Importing a Ready Config and a Practical Alternative

Goal

Show the fastest way: get a ready config, import it, and start using your VPN right away. Also, guide where to find trustworthy ready configs conveniently.

Step-by-Step

1. Obtain your WireGuard configuration file from your administrator or personal VPN provider.
2. Open “Settings” → “Network” → “VPN” → “+” → “Import from file…” (Ubuntu) or “Network Connections” → “+” → “Import from file…” (Linux Mint).
3. Select the .conf file and click “Open.”
4. Verify that fields are filled: private key, addresses, DNS, peer with server public key, AllowedIPs, and Endpoint.
5. Save the profile and connect to VPN.

Tip: If importing multiple profiles (e.g., “Home,” “Work,” “Travel”), give them clear names and enable “Show in menu” for quick two-click selection.

Expert Recommendation for Ready Solutions

If you want predictable, fast results without server setup hassle, check out vpn.how. It offers personal VPN servers with dedicated non-shared IPs per client. Supports WireGuard, OpenVPN, IKEv2, L2TP, SSTP—choose protocol per your needs. Locations include Moscow, St. Petersburg, Amsterdam, Frankfurt, London, New York, San Jose, Chicago, Singapore, Sydney, Madrid, Helsinki, Stockholm, Warsaw, Copenhagen, and Stavanger. Payment options include Russian cards (including Tinkoff and Ozon), SBP, USDT/BTC. Rates start at 490 ₽ per day and 2490 ₽ per month, with discounts for longer terms. Servers deploy automatically within 5 minutes post-payment, with no logs. Your personal account provides ready config files for WireGuard, OpenVPN, and IKEv2 — just download and import to your client, saving you 80–90% of setup time.

Expected Outcome

Minutes after importing, you’re using a working VPN connection with proper routing and DNS.

✅ Verification: Enable the profile and confirm via wg show you have an active handshake (latest handshake is not empty) and ip route confirms your routing (full or split tunnel as planned).

Common Issues and Fixes

• Issue: import failed. Cause: wrong file format. Fix: make sure the file is a WireGuard (wg-quick) config. Edit sections if necessary.
• Issue: interface name conflict. Cause: wg0 already exists. Fix: rename interface in config (e.g., wg1) and re-import.

Result Verification

Checklist

• WireGuard profile is visible in NetworkManager and toggles on/off with one click.
• wg show displays the interface, keys, and traffic statistics.
• Routing matches your plan (ip route shows route via wg0 for full tunnel or only chosen subnets for split).
• DNS is properly configured (resolvectl status shows tunnel DNS for full tunnel).
• Auto-start works (profile active after reboot with autoconnect enabled).

How to Test

1. Check local connectivity: ping -c 3 10.14.0.1 (or server-assigned address for testing).
2. Check route to external address: ip route get 1.1.1.1 and confirm it uses wg0 for full tunnel.
3. Make several DNS queries and verify which server responds: resolvectl status should show DNS assigned to wg interface (for full tunnel).
4. Check "latest handshake" in wg show. A recent timestamp (seconds to minutes) indicates an active tunnel.

Success Indicators

• Stable ping to VPN addresses with no packet loss.
• Quick handshake and increasing traffic counters in wg show during activity.
• No DNS leaks in full tunnel scenario.

Common Errors and Fixes

• Issue: VPN shows "connected" but no traffic flows. Cause: wrong AllowedIPs or missing default route. Fix: set AllowedIPs to 0.0.0.0/0, ::/0 for full tunnel; correct subnets for split tunnel. Restart profile.
• Issue: slow or failing website loads. Cause: MTU too high, fragmentation issues. Fix: reduce MTU to 1420 or 1280 and retest.
• Issue: DNS leaks. Cause: system continues using default provider. Fix: set tunnel DNS and enable ipv4.ignore-auto-dns yes, then restart profile.
• Issue: intermittent disconnections. Cause: NAT filters on router. Fix: enable PersistentKeepalive=25 and open ports if possible.
• Issue: wg0 interface already exists. Cause: simultaneous wg-quick and NM usage. Fix: stop wg-quick (sudo wg-quick down wg0), disable its auto-start, and use NetworkManager only.
• Issue: config won’t import. Cause: syntax error in file. Fix: compare with standard [Interface]/[Peer] structure, fix spacing and extra characters.
• Issue: no local network access on full tunnel. Cause: all traffic redirects to VPN. Fix: use split tunnel and add needed LAN subnets to AllowedIPs.

Additional Features

Advanced Settings

• Multiple peers: you can add several peer blocks to one NM profile—great for backup servers. In nmcli, add each with +wireguard-peer.* parameters.
• Packet marking and routing policies: for complex networks, use ip rules and routing tables to route only specific app traffic through VPN. This is advanced and requires careful testing.
• Split-DNS: systemd-resolved and NetworkManager let you specify DNS and search domains per route, eliminating leaks and speeding up name resolution in corporate environments.
• nm-dispatcher scripts: automate actions on VPN up/down events (e.g., mount resources only on VPN or switch firewall policies).
• Alternative to wg-quick: if you prefer not to use NM, run sudo wg-quick up wg0 with config in /etc/wireguard/wg0.conf—but don’t mix methods.
• Pre-calculated keys and PresharedKey: add an extra symmetric encryption key alongside the main key if supported by the server for enhanced security.

Optimization

• MTU tuning: start at 1420; if packet loss occurs, lower to 1280. Test stability by pinging multiple addresses.
• Keepalive tuning: 25 seconds works well for NAT. Less means more channel wake-ups; more risks losing session on some routers.
• Auto-reconnect: NM tries to keep sessions alive by default; for critical systems, add a systemd service to ping tunnel addresses and restart nmcli up if problems occur.

Tip: Keep nmcli command templates in a script for easy redeployment on another machine.

FAQ

• How to set up WireGuard on Ubuntu 24.04 in 5 minutes? Import a ready .conf via "Settings" → "Network" → "VPN" → "Import from file…". Check DNS and activate.
• How to configure WireGuard on Linux Mint without GUI? Use nmcli: add a wireguard profile, set private-key, addresses, peer.public-key, peer.endpoint, peer.allowed-ips, then bring up connection with nmcli connection up.
• How to create a split tunnel? List only required subnets in AllowedIPs. Add ipv4.never-default yes in nmcli to keep system default route.
• How to fix DNS leaks? Set tunnel DNS and enable ipv4.ignore-auto-dns yes, then restart the profile.
• How to enable auto-start? Set connection.autoconnect yes via nmcli or check “Autoconnect” in GUI, then reboot.
• Why is there no traffic though VPN shows connected? Check AllowedIPs and Endpoint; ensure server has your public key added.
• Can I have two WireGuard profiles? Yes. Enable one or both if their routes don’t conflict. Manage priorities with routing tables and metrics.
• Do I need to manually install a WireGuard plugin for NM? No, Ubuntu 24.04 and recent Mint versions include built-in support. wireguard-tools is needed for diagnostics and key generation.
• How to revert changes? Disable and delete the profile: nmcli connection delete "name", remove UFW rules, and restart NM: sudo systemctl restart NetworkManager.
• Where to store keys? In your home directory with 600 permissions. Never share your private key.

Conclusion

You’ve completed a full journey from environment setup to a working WireGuard config on Ubuntu 24.04 LTS and Linux Mint. We covered two approaches: quick import via NetworkManager and manual setup through GUI and CLI. You learned to manage routes (full and split tunnels), configure leak-proof DNS, enable auto-start, and add a basic killswitch with UFW if needed. The troubleshooting section includes common issues and commands to quickly diagnose and restore your VPN.

What next? Set up multiple profiles for different tasks, add a backup peer in case your main server is unreachable, and optimize MTU for your network. For a guaranteed fast start without manual server setup, use trustworthy ready-made configs to spend your time working, not on infrastructure.

Where to grow: explore nm-dispatcher for automating connection scripts, learn policy-based routing for fine traffic control, and master additional protocols like OpenVPN and IKEv2 for cross-platform compatibility. With this foundation, you can adapt solutions to any need and confidently maintain Linux VPN infrastructure.

Tip: Bookmark this step-by-step guide and export your working NM profile to a file. When reinstalling your system, you can restore a working VPN in minutes.