[GUIDE] How-to Use WireGuard on Android, Ubuntu, and macOS

Search This thread

TheVPNGuy

New member
Dec 22, 2017
2
85
UPDATE UPDATE UPDATE -- OCTOBER 4, 2018: AzireVPN is no longer free, and therefore the below instructions will no longer work for non-paying folks, which is probably most of XDA. For this reason, you are advised to now use your own judgement when selecting a WireGuard VPN host. Two recommended ones, as of writing, are:

- Mullvad - more servers, better bandwidth, more mature company
- AzireVPN - newer, has IRC channel, uses custom PXE-booting hardware

Even better, however, is that you run your own server using an inexpensive (or sometimes free) VPS.

If other providers become free, we can update this thread.




WireGuard is a next-generation VPN protocol that's extremely fast, secure, and well suited for mobile devices. It was recently featured on XDA news and there's an active thread for developers-only. This post is a how-to for normal people.

WireGuard is just the protocol and software. But to use it, you need to send your traffic through a server. There are a few commercial providers -- AzireVPN and Mullvad, for example -- or you can setup your own server. This guide will focus on AzireVPN, simply because as of writing, it's free, not because it's any better or worse than others.



==== For your Android Phone ====

1. Install the WireGuard app: https://play.google.com/store/apps/details?id=com.wireguard.android

2. Sign up for AzireVPN: https://www.azirevpn.com/manager/auth/register

3. Generate and download a configuration zip from: https://www.azirevpn.com/cfg/wireguard

4. Import it into the WireGuard app using "Add from file or archive"



==== For your Ubuntu Computer ====

1. Install WireGuard:
Code:
$ sudo add-apt-repository ppa:wireguard/wireguard
$ sudo apt-get update
$ sudo apt-get install wireguard-dkms wireguard-tools linux-headers-$(uname -r)

2. Sign up for AzireVPN: https://www.azirevpn.com/manager/auth/register

3. Run the Azire script:
Code:
$ curl -LO https://www.azirevpn.com/dl/azirevpn-wg.sh
$ chmod +x ./azirevpn-wg.sh
$ ./azirevpn-wg.sh

4. Turn on WireGuard:
Code:
$ wg-quick up azirevpn-se1



==== For your macOS Computer ====

1. Install Homebrew: https://brew.sh

2. Install WireGuard:
Code:
$ brew install wireguard-tools

3. Sign up for AzireVPN: https://www.azirevpn.com/manager/auth/register

4. Run the Azire script:
Code:
$ curl -o azirevpn-wg.sh https://www.azirevpn.com/dl/azirevpn-wg.sh
$ chmod +x ./azirevpn-wg.sh
$ ./azirevpn-wg.sh

5. Turn on WireGuard:
Code:
$ wg-quick up azirevpn-se1



That should be it!


Direct any questions to the WireGuard IRC channel -- #wireguard on Freenode.
 
Last edited:

kantjer

Inactive Recognized Contributor
Dec 11, 2010
12,393
29,850
www.androidfilehost.com
I have setup WireGuard a few days ago on Android exactly as descripted in the howto. Everything is working perfect only issue I can't access devices on my local network with WG enabled.
I have been looking for a way to bypass WG for local traffic but haven't found a solution yet.

Any tips on how to this, or alternatively is is possible to switch WG on/off via the command line so I can use Tasker to switch WG off when on my local network.
 

zx2c4

Recognized Developer
Sep 12, 2013
213
852
Paris
www.zx2c4.com
I have setup WireGuard a few days ago on Android exactly as descripted in the howto. Everything is working perfect only issue I can't access devices on my local network with WG enabled.
I have been looking for a way to bypass WG for local traffic but haven't found a solution yet.

Any tips on how to this, or alternatively is is possible to switch WG on/off via the command line so I can use Tasker to switch WG off when on my local network.

Thanks for the report. I'm wrapped up in end of the year festivities right now, but when that's over I'll try to reproduce the local network issue and see if I can provide a workaround or toggle switch.

In the meantime, indeed you can use Tasker as you described. In the settings menu of the app, choose "Install command line tools." After, you'll be able to type "wg-quick up somename" and "wg-quick down somename." You can look at the status of existing vpn connections with the "wg" command too. Let me know how it goes!
 

kantjer

Inactive Recognized Contributor
Dec 11, 2010
12,393
29,850
www.androidfilehost.com
In the meantime, indeed you can use Tasker as you described. In the settings menu of the app, choose "Install command line tools." After, you'll be able to type "wg-quick up somename" and "wg-quick down somename." You can look at the status of existing vpn connections with the "wg" command too. Let me know how it goes!

The wg-quick up/down works perfect for temporary disable WG to sync with my NAS. Thanks for the tip.
 
  • Like
Reactions: mustache

dixan43

Senior Member
Oct 19, 2013
488
97
Anand
error bringing up tunnel.. can anybody help me with a working configuration file.. pm me the file..
 

dixan43

Senior Member
Oct 19, 2013
488
97
Anand
No. Send logs from `adb logcat` or the Matlog app instead, so we can help solve this issue.
beacon kernel developer here suggested me to turn off internet and connect wireguard config and then turn on internet.. and it just connected with internet off.. so is it supposed to work like that?
-- so when I connect it with internet already on, it gives that error..
-- when internet off, it connects and remains connected there after..
 

zx2c4

Recognized Developer
Sep 12, 2013
213
852
Paris
www.zx2c4.com

zx2c4

Recognized Developer
Sep 12, 2013
213
852
Paris
www.zx2c4.com
beacon kernel developer here suggested me to turn off internet and connect wireguard config and then turn on internet.. and it just connected with internet off.. so is it supposed to work like that?
-- so when I connect it with internet already on, it gives that error..
-- when internet off, it connects and remains connected there after..

I wish such "kernel developer"s would try debugging the issue with me first -- to get at whatever the core problem is -- before doling out dubious incantations like that. Alas.
 
  • Like
Reactions: drewski_1

zx2c4

Recognized Developer
Sep 12, 2013
213
852
Paris
www.zx2c4.com
despite that error, yu can still connect to VPN by disabling internet, then connect.. it will connect.. then just switch internet on.

He's facing a different issue. Please stop spreading this advice, even if it works. It's a terrible way of "fixing" things and will just ensure people's issues never get fixed the proper way.
 

zx2c4

Recognized Developer
Sep 12, 2013
213
852
Paris
www.zx2c4.com
Same error bringing up tunnel.

You're actually encountering a different error. Specifically, for you, it's -- "12-26 21:49:02.224 V/WireGuard/RootShell(972): stderr: RTNETLINK answers: Out of memory", in response to `ip link add wg0 type wireguard`. That's super unexpected and weird. Could you tell me what kernel you're running on your phone (link to xda thread and github too), what phone you have, and whatever other useful information you can come up with? Does your phone, in fact, have a super limited amount of ram? I'll likely need to bring out the heavy machinery here.
 

anwarsheriff

Senior Member
Mar 5, 2008
89
17
Chennai
You're actually encountering a different error. Specifically, for you, it's -- "12-26 21:49:02.224 V/WireGuard/RootShell(972): stderr: RTNETLINK answers: Out of memory", in response to `ip link add wg0 type wireguard`. That's super unexpected and weird. Could you tell me what kernel you're running on your phone (link to xda thread and github too), what phone you have, and whatever other useful information you can come up with? Does your phone, in fact, have a super limited amount of ram? I'll likely need to bring out the heavy machinery here.

Phone being used: Redmi Note 3 with 3gb ram and 32gb storage.

ROM & Android version: Nitrogen OS 8.1
Link to ROM thread: https://xdaforums.com/redmi-note-3/development/rom-nitrogen-os-11-01-2017-t3536211

Kernel used: Agni AGNi pureLOS-N/O v11.8
Link to thread: https://xdaforums.com/redmi-note-3/development/kernel-02-10-2016-agni-purecm-n-v1-7-t3472640

Hope that helps

---------- Post added at 09:32 PM ---------- Previous post was at 09:12 PM ----------

You're actually encountering a different error. Specifically, for you, it's -- "12-26 21:49:02.224 V/WireGuard/RootShell(972): stderr: RTNETLINK answers: Out of memory", in response to `ip link add wg0 type wireguard`. That's super unexpected and weird. Could you tell me what kernel you're running on your phone (link to xda thread and github too), what phone you have, and whatever other useful information you can come up with? Does your phone, in fact, have a super limited amount of ram? I'll likely need to bring out the heavy machinery here.


Well to keep you updated. I cleaned the ROM and tried another wireguard implemented kernel. No issues anymore. It gets connected.

Working kernel Link: https://xdaforums.com/redmi-note-3/development/kernel-shadow-kernel-redmi-note-3-kenzo-t3689866


Was it the kernel or the wireguard app update that fixed the issue?
 

dixan43

Senior Member
Oct 19, 2013
488
97
Anand
Thanks for the extremely useful log file. The issue is that your external interface has too small of an MTU, so v6 fails. I've fixed wg-quick so silently work around this error here -- https://git.zx2c4.com/wireguard-android/commit/?id=f1f36fb600ffdaa59f838f6866f594e8e690170d -- and I uploaded a new version to the play store. After you update, let me know if the error goes away for you.
yea the error is gone.. it's fixed with the update.. thnx.
 

anujyadava

Senior Member
Mar 1, 2014
1,007
296
Samsung Galaxy S10 Lite
Which ones to use for fastest internet and best battery life?
I am from India
 

Attachments

  • Screenshot_20171227-214902.jpg
    Screenshot_20171227-214902.jpg
    103.8 KB · Views: 1,630
Hi,

Just wondering about the Wireguard Android app. I have blu_spark, latest which supports Wireguard and the Android app. I aslo have the name and public key for the Mullvad Wireguard server. My question is on the Android app:

Under Interface,
Name: <<should be my Wireguard provider? E.g., Mullvad?>>
Address: <<should be blank? My behind-NAT-address such as 192.168.1.41? Router IP address such as 64.121.124.59? Or something like 0.0.0.0?>>

Under Peer,
Allowed IPs: <<should be same as Interface Address? Something else?>>
Endpoint: <<should be the ip address/name of Mullvad WG server?>>

Thanks.
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 79
    UPDATE UPDATE UPDATE -- OCTOBER 4, 2018: AzireVPN is no longer free, and therefore the below instructions will no longer work for non-paying folks, which is probably most of XDA. For this reason, you are advised to now use your own judgement when selecting a WireGuard VPN host. Two recommended ones, as of writing, are:

    - Mullvad - more servers, better bandwidth, more mature company
    - AzireVPN - newer, has IRC channel, uses custom PXE-booting hardware

    Even better, however, is that you run your own server using an inexpensive (or sometimes free) VPS.

    If other providers become free, we can update this thread.




    WireGuard is a next-generation VPN protocol that's extremely fast, secure, and well suited for mobile devices. It was recently featured on XDA news and there's an active thread for developers-only. This post is a how-to for normal people.

    WireGuard is just the protocol and software. But to use it, you need to send your traffic through a server. There are a few commercial providers -- AzireVPN and Mullvad, for example -- or you can setup your own server. This guide will focus on AzireVPN, simply because as of writing, it's free, not because it's any better or worse than others.



    ==== For your Android Phone ====

    1. Install the WireGuard app: https://play.google.com/store/apps/details?id=com.wireguard.android

    2. Sign up for AzireVPN: https://www.azirevpn.com/manager/auth/register

    3. Generate and download a configuration zip from: https://www.azirevpn.com/cfg/wireguard

    4. Import it into the WireGuard app using "Add from file or archive"



    ==== For your Ubuntu Computer ====

    1. Install WireGuard:
    Code:
    $ sudo add-apt-repository ppa:wireguard/wireguard
    $ sudo apt-get update
    $ sudo apt-get install wireguard-dkms wireguard-tools linux-headers-$(uname -r)

    2. Sign up for AzireVPN: https://www.azirevpn.com/manager/auth/register

    3. Run the Azire script:
    Code:
    $ curl -LO https://www.azirevpn.com/dl/azirevpn-wg.sh
    $ chmod +x ./azirevpn-wg.sh
    $ ./azirevpn-wg.sh

    4. Turn on WireGuard:
    Code:
    $ wg-quick up azirevpn-se1



    ==== For your macOS Computer ====

    1. Install Homebrew: https://brew.sh

    2. Install WireGuard:
    Code:
    $ brew install wireguard-tools

    3. Sign up for AzireVPN: https://www.azirevpn.com/manager/auth/register

    4. Run the Azire script:
    Code:
    $ curl -o azirevpn-wg.sh https://www.azirevpn.com/dl/azirevpn-wg.sh
    $ chmod +x ./azirevpn-wg.sh
    $ ./azirevpn-wg.sh

    5. Turn on WireGuard:
    Code:
    $ wg-quick up azirevpn-se1



    That should be it!


    Direct any questions to the WireGuard IRC channel -- #wireguard on Freenode.
    15
    Hello guys,

    Just wanted to let you all know that we have upgraded US, CA and ES WireGuard servers at AzireVPN this morning. All keys had to be wiped, so you will have to re-create your keys again.
    New hardware have also been added to support the increased demand from WireGuard users, it's really fun to see the interest from XDA community!
    If you have any feedback specific for the AzireVPN<>WireGuard integration, don't hesitate to contact us and share it with us.

    /AzireVPN
    14
    Azire is a leaky VPN.

    https://www.dailydot.com/debug/leaking-vpns/

    that's the paid version I tested too. I can only imagine how bad the free version is.:(

    I don't care to defend any commercial VPN providers or make any claims about the quality of their services. However, your comment here is wrong and distracting, and needs to be corrected before others run with the FUD you're spreading.

    "Leaking" -- in the context of the commercial VPN industry's marketing stupidity -- means the software you've installed lets some packets leave your computer through your ordinary internet connection instead of through the VPN's internet connection. It's not a quality of the provider's servers or service; it's rather a quality of the provider's software.

    So, you read an article about a provider shipping software that "leaks" to its users. That provider also happens to support WireGuard. Then you came and complained about it.

    The reason that doesn't make sense is because if you follow the instructions of this thread, you won't be running software from any commercial VPN provider. You will be using their servers and service, yes, but you won't be running their software, which might, as the article mentioned, have "leaks".

    Instead, you'll be running my software. That's what this thread instructs you to use, after all. And if you do find that my software "leaks" or is otherwise deficient, just come here screaming about it, and we'll find a good solution together.
    9
    New endpoint IP US1

    Hey guys,
    Just to let you know that we have been forced to change our IP ranges in US1. You need to update the Endpoint IP for US config to 107.178.59.60 or download a new configuration.
    /Team AzireVPN
    8
    One thing I should emphasize here is:

    • WireGuard is a protocol, a technology, a kernel module, an app, an open source project, which I made
    • "AzireVPN" is the name of a random VPN provider that happens to be providing free service, which I have nothing at all to do with

    In other words, "WireGuard" does not equal "AzireVPN". AzireVPN happens to support WireGuard, and happens to currently give free accounts, but that's about it.

    It looks to me like "AzireVPN" has a tendency to wipe people's keys every time they update something. What this means is that you have to go back to the configuration generator and redownload/reimport the configs into the WireGuard app. I've just contacted the Azire people to scold them, on behalf of the frustrated users of this thread, so that they don't do this again. Hopefully this is the last warning they'll need, and now they'll offer a decent service. But, for everyone who suddenly "lost access" or had their app "stop working", just delete the existing configs and redownload/reimport new ones.

    Hopefully, there will be some additional free providers soon for you all too.