wireguard
About
Mainlined with Linux 5.6. 
No DKMS needed anymore.
Installation
1 aptitude install wireguard
With linux version < 5.6, this will also install wireguard-dkms as a dependency, an out-of-tree module, yet. With DKMS you will be forced to disable Secure Boot in BIOS to load this module, because it's not signed by Microsoft, because it's built locally. I got the following error:
Configure
Create keys
Create keys
1 ### SUBSHELL TO LIMIT UMASK
2 sh
3 NAME="${HOSTNAME%.*}"
4 #NAME="test"
5 PREFIX="/etc/wireguard/$NAME";
6 umask 077;
7 [ -d "$PREFIX" ] || mkdir -p "$PREFIX";
8 cd "$PREFIX";
9 wg genkey > "$PREFIX/wg_$NAME.key";
10 wg pubkey < "$PREFIX/wg_$NAME.key" > "$PREFIX/wg_$NAME.pub";
11 wg genpsk > "$PREFIX/wg_$NAME.psk";
12 exit
Please remember:
Always generate a new PSK for any new connection, to not put the secrecy of other connections at risk.
Client
Create wg-quick config
/etc/wireguard/wg_libertas.conf
1 ###WIREGUARD CONFIG
2 #HOST: "libertas"
3 #PEER: "hostname.dyna.rockstable.it"
4 #DATE: "2020-12-25"
5
6 [Interface]
7 DNS = 10.255.255.1/24
8 #MTU =
9 #Table =
10 #PreUp =
11 #PostUp =
12 #PreDown =
13 #PostDown =
14 #SaveConfig = false
15 PrivateKey = eOPGzM9Sa8LR3Q/zD17q6zPOLYSx3D/d0Jb2QeskjHQ=
16 #FwMark =
17 ListenPort = 51820
18
19 [Peer]
20 PublicKey = e3ZITGXKIUXrtjg0/0LAt2/lSuJtASX3/25itWLwBRA=
21 Endpoint = hostname.dyna.rockstable.it:51820
22 AllowedIPs = 10.255.255.0/24
23 AllowedIPs = 0.0.0.0/0
24 #AllowedIPs = 0.0.0.0/0, ::/0
25 PresharedKey = JNVOOUGtSJv9iqaoX63da3Xx1dzTWdk13+hXyoyfM0w=
26 #PersistentKeepalive =
When the server is configured, start the tunnel.
Server
Create wg-quick config
/etc/wireguard/wg_hostname.conf
Start listening
Start on boot
There is a parameterized service in SystemD
1 systemctl enable wg-quick@wg_hostname.service
To identify such services
/etc/systemd/system/multi-user.target.wants/wg-quick@wg_hostname.service
1 [Unit]
2 Description=WireGuard via wg-quick(8) for %I
3 After=network-online.target nss-lookup.target
4 Wants=network-online.target nss-lookup.target
5 PartOf=wg-quick.target
6 Documentation=man:wg-quick(8)
7 Documentation=man:wg(8)
8 Documentation=https://www.wireguard.com/
9 Documentation=https://www.wireguard.com/quickstart/
10 Documentation=https://git.zx2c4.com/wireguard-tools/about/src/man/wg-quick.8
11 Documentation=https://git.zx2c4.com/wireguard-tools/about/src/man/wg.8
12
13 [Service]
14 Type=oneshot
15 RemainAfterExit=yes
16 ExecStart=/usr/bin/wg-quick up %i
17 ExecStop=/usr/bin/wg-quick down %i
18 ExecReload=/bin/bash -c 'exec /usr/bin/wg syncconf %i <(exec /usr/bin/wg-quick strip %i)'
19 Environment=WG_ENDPOINT_RESOLUTION_RETRIES=infinity
20
21 [Install]
22 WantedBy=multi-user.target