How to set up a manual WireGuard® connection on Linux? – Surfshark Customer Support

In this article, you will learn how to set up a manual WireGuard® connection on your Linux device via CLI or Network Manager. We offer guidance for both in case you're unable to use one or the other method

To proceed, you first need an active Surfshark subscription. You can find the available plans on Surfshark’s pricing page.

NOTE: These guides are applicable for Ubuntu, Mint, Debian, Kubuntu, Lubuntu, Xubuntu, MX Linux, Arch, Manjaro, Fedora, and Redhat distributions.

Select your desired setup method:

CLI setup
Network Manager setup

Follow the steps below to set up a WireGuard® connection on your Linux device via CLI.

The steps needed for a CLI setup:

Get your key pair
I have a key pair
I don't have a key pair
Choose a Surfshark server
Download WireGuard® and connect to the VPN

Get your key pair

There are two ways we can go from here. You might have generated a key pair, and you'll be able to use it. Or, we will have to generate one.

If you have a key pair already, continue the tutorial as usual. If you do not, you should move on to the I don’t have a key pair section.

I have a key pair

Go to Surfshark's login page and log in. Then, visit VPN > Manual setup. Choose the Desktop or mobile option and click on WireGuard.
In the next window, click on I have a key pair.
Name your key pair and click Next.
Enter your public key and hit Save.

I don't have a key pair

Go to Surfshark's login page and log in. Then, visit VPN > Manual setup. Choose the Desktop or mobile option and click on WireGuard.
In the next window, click on I don't have a key pair.
Name your new key pair.
Click on Generate a new key pair.

NOTE: Copy and store the generated key pairs on your device. You will not be able to check them here again.

Choose a Surfshark server

Once you have your key pair, you should see a Choose a location button. Click on it. Here, you'll find the list of available locations to connect to. Select one and keep this window open, as we'll need it for later.

NOTE: You will need the Server public key highlighted above later in the setup.

Install WireGuard® & connect to a server

Follow the steps below to install the WireGuard® package, which we will then configure to use to connect.

In order to connect to WireGuad®, you'll have to download the official WireGuard® VPN CLI tool for your distribution.

From the available list, select your distribution, copy the command, and paste it into your Linux device terminal.
As indicated in the choose a Surfshark server section above, download the configuration of your desired location and move it to the /etc/wireguard/ directory.

In our example, we're using the US-Detroit server, which is named us-dtw.conf and is in the Downloads folder. To move it, we used the following:
```
sudo mv ~/Downloads/us-dtw.conf /etc/wireguard/
```
To connect, enter the following command in the terminal window while replacing [configuration file name] with your location's name without the .conf prefix:
```
sudo wg-quick up [configuration file name]
```
In our example, the command is as follows:
```
sudo wg-quick up us-dtw
```
To verify your connection, enter the following command:
```
sudo wg
```
You'll then be presented with your connection status, where you'll see your IP, public & peer keys, and other information.
To disconnect, enter the following while replacing [configuration file name] with your location's name without the .conf prefix:
```
sudo wg-quick down [configuration file name]
```
In our case:
```
sudo wg-quick down us-dtw
```

Follow the steps below to set up a WireGuard® connection on your Linux device via Network Manager.

The following steps are needed for a Network Manager setup:

Get your key pair
I have a key pair
I don't have a key pair
Choose a Surfshark server
Download WireGuard® and connect to the VPN

Get your key pair

There are two ways we can go from here. You might have generated a key pair, and you'll be able to use it. Or, we will have to generate one.

If you have a key pair already, continue the tutorial as usual. If you do not, you should move on to the I don’t have a key pair section.

I have a key pair

Go to Surfshark's login page and log in. Then, visit VPN > Manual setup. Choose the Desktop or mobile option and click on WireGuard.
In the next window, click on I have a key pair.
Name your key pair and click Next.
Enter your public key and hit Save.

I don't have a key pair

Go to Surfshark's login page and log in. Then, visit VPN > Manual setup. Choose the Desktop or mobile option and click on WireGuard.
In the next window, click on I don't have a key pair.
Name your new key pair.
Click on Generate a new key pair.

NOTE: Copy and store the generated key pairs on your device. You will not be able to check them here again.

Choose a Surfshark server

Download and install WireGuard®

Follow the steps below to install the WireGuard® package, which we will then configure on the Network Manager.

Begin with running the following command in the Terminal if you are using Ubuntu, Mint, Debian, Kubuntu, Lubuntu, Xubuntu, MX Linux:
```
sudo apt install wireguard
```
If you are using Arch or Manjaro:
```
sudo pacman -Syu wireguard-tools
```
If you are using Fedora, Redhat:
```
sudo dnf install wireguard-tools
```
Open Network Manager, or as it is sometimes referred to, Advanced Network Configuration. The window you see may be different depending on the Linux distribution you are using.

You can also open Advanced Network Configuration via terminal by typing in the following command:
```
nm-connection-editor
```
Click the + button.
In the following window, select the connection type. In the dropdown menu, choose WireGuard under the Virtual tab.

Fill in the details as seen in the window below:

Connection name: Any name you like (we recommend naming it as the server you're connecting to)
Interface name: surfshark_wg
Private key: Enter your private key (refer to Get your key pair section in this article)
Listen port: 32
Fwmark: 51820
MTU: 1280

Next, configure the Peers. Press Add in the Peers section.
Fill in the following information:

Public key: Server public key (refer to Choose a server section in this article)
Allowed IPs: 0.0.0.0/0
Endpoint: example.prod.surfshark.com:51820
Click Apply.
Now, click on the IPv4 Settings.
Enter the following information:

Address: 10.14.0.2
Netmask: 16
Gateway: leave the field empty
DNS servers: 162.252.172.57, 149.154.159.92
Search domains: ~.
Click Save.

Connect to the VPN

At the top right corner of your screen, press on the network icon.
Select your VPN connection.

Ensure the connection is successful

We always recommend checking if Surfshark VPN is working after setting it up for the first time. You can easily do it by performing Surfshark IP leak test and a DNS leak test. For your convenience, both are available on our website.