How to set up a manual WireGuard® connection on Linux via Network Manager – Surfshark Customer Support

In this article, you will learn how to set up a manual WireGuard® connection on your Linux device via Network Manager.

To proceed, you first need an active Surfshark subscription. You can find the available plans on Surfshark’s pricing page.

NOTE: This guide will cover Ubuntu, Mint, Debian, Kubuntu, Lubuntu, Xubuntu, MX Linux, Arch, Manjaro, Fedora, and Redhat distributions.

We will cover the following steps:

Get your key pair
I have a key pair
I don't have a key pair
Choose a Surfshark server
Download WireGuard® and connect to the VPN
Ensure the connection is successful

Get your key pair

There are two ways we can go from here. You might have generated a key pair, and you'll be able to use it. Or, we will have to generate one.

If you have a key pair already, continue the tutorial as usual. If you do not, you should move on to the I don’t have a key pair section.

I have a key pair

Go to Surfshark's login page and log in. Then, visit VPN > Manual setup. Choose the Desktop or mobile option and click on WireGuard.
In the next window, click on I have a key pair.
Name your key pair and click Next.
Enter your public key and hit Save.

I don't have a key pair

Go to Surfshark's login page and log in. Then, visit VPN > Manual setup. Choose the Desktop or mobile option and click on WireGuard.
In the next window, click on I don't have a key pair.
Name your new key pair.
Click on Generate a new key pair.

NOTE: Copy and store the generated key pairs on your device. You will not be able to check them here again.

Choose a Surfshark server

Once you have your key pair, you should see a Choose a location button. Click on it. Here, you'll find the list of available locations to connect to. Select one and keep this window open, as we'll need it for later.

NOTE: You will need the Server public key highlighted above later in the setup.

Download and install WireGuard®

Follow the steps below to install the WireGuard® package, which we will then configure on the Network Manager.

Begin with running the following command in the Terminal if you are using Ubuntu, Mint, Debian, Kubuntu, Lubuntu, Xubuntu, MX Linux:
```
sudo apt install wireguard
```
If you are using Arch or Manjaro:
```
sudo pacman -Syu wireguard-tools
```
If you are using Fedora, Redhat:
```
sudo dnf install wireguard-tools
```
Open Network Manager, or as it is sometimes referred to, Advanced Network Configuration. The window you see may be different depending on the Linux distribution you are using.

You can also open Advanced Network Configuration via terminal by typing in the following command:
```
nm-connection-editor
```
Click the + button.
In the following window, select the connection type. In the dropdown menu, choose WireGuard under the Virtual tab.

Fill in the details as seen in the window below:

Connection name: Any name you like (we recommend naming it as the server you're connecting to)
Interface name: surfshark_wg
Private key: Enter your private key (refer to Get your key pair section in this article)
Listen port: 32
Fwmark: 51820
MTU: 1280

Next, configure the Peers. Press Add in the Peers section.
Fill in the following information:

Public key: Server public key (refer to Choose a server section in this article)
Allowed IPs: 0.0.0.0/0
Endpoint: example.prod.surfshark.com:51820
Click Apply.
Now, click on the IPv4 Settings.
Enter the following information:

Address: 10.14.0.2
Netmask: 16
Gateway: leave the field empty
DNS servers: 162.252.172.57, 149.154.159.92
Search domains: ~.
Click Save.

Connect to the VPN

At the top right corner of your screen, press on the network icon.
Select your VPN connection.

Ensure the connection is successful

We always recommend checking if Surfshark VPN is working after setting it up for the first time. You can easily do it by performing Surfshark IP leak test and a DNS leak test. For your convenience, both are available on our website.