← Docs / Gateway
Gateway on Linux
The Gateway page offers two downloads. Choose Linux (advanced) for a server: it shows a Linux command under Linux. After you choose Generate keys in my browser, run that command on the machine:
sudo sh -c 'command -v wg >/dev/null || (apt-get install -y wireguard-tools || dnf install -y wireguard-tools); umask 077; echo <your config> | base64 -d > /etc/wireguard/pbgw.conf; systemctl enable --now wg-quick@pbgw'
It installs WireGuard if needed, writes your config to /etc/wireguard/pbgw.conf, starts the tunnel and starts it again at every boot.
If the install step fails with "Unable to locate package", run sudo apt-get update and run the command again.
To do it by hand instead, copy the downloaded pb-gateway-linux.conf to /etc/wireguard/pbgw.conf, run sudo chmod 600 /etc/wireguard/pbgw.conf, then sudo systemctl enable --now wg-quick@pbgw.
Do not run wg-quick up on the downloaded file directly. Linux limits interface names to 15 characters, and pb-gateway-linux (16) and pb-gateway-device (17) are longer. Copy the file to pbgw.conf as above; the command does this for you.
Check it worked
sudo wg show pbgw latest-handshakes
curl -4 --interface 203.0.113.25 https://ifconfig.me
The first command prints a timestamp. If it prints 0, there has been no handshake yet; see getting connected. The second prints your Gateway. The Gateway page also changes to connected.
curl -4 https://ifconfig.me without --interface still prints the machine's own address. That is expected in server mode.
What the default config does
Only traffic from your Gateway uses the tunnel. Connections to the Gateway arrive on the pbgw interface and the replies go back the same way. Everything else keeps using the machine's normal connection, including SSH to its own address.
Stopping the tunnel with sudo systemctl stop wg-quick@pbgw leaves the machine's networking exactly as it was.
To run a service on the Gateway, or send one app or user through it, see Run a server or app on your Gateway.
Allow inbound traffic in your firewall
Connections to the Gateway arrive on pbgw, so your firewall has to let them in. With ufw:
sudo ufw allow in on pbgw to any port 443 proto tcp
This opens port 443 on the Gateway only. The machine's own address stays as it was.
Full tunnel: send everything through the Gateway
With the Linux (advanced) config, edit /etc/wireguard/pbgw.conf and delete the Table, PostUp and PostDown lines.
On a desktop there is a shorter route: download Phone or computer, copy it to /etc/wireguard/pbgw.conf, and skip the edit. It is already full tunnel. On a remote server, still add the SSH rule in the warning below.
[Interface], using the server's own public IPv4 in place of 203.0.113.80. They keep everything addressed to the server's own IP on its normal connection.PostUp = ip rule add from 203.0.113.80 lookup main priority 100
PostDown = ip rule del from 203.0.113.80 lookup main priority 100
Arm an automatic undo, then restart the tunnel:
sudo systemd-run --unit=pbgw-undo --on-active=180 systemctl stop wg-quick@pbgw
sudo systemctl restart wg-quick@pbgw
curl -4 https://ifconfig.me
The last command now prints your Gateway. If your SSH session froze, wait three minutes and the tunnel stops itself. If it worked, cancel the undo within the three minutes: sudo systemctl stop pbgw-undo.timer.
The Phone or computer config already has DNS = 1.1.1.1, 9.9.9.9, so name lookups go through the tunnel. With the Linux (advanced) config you can add the same line under [Interface]. If the tunnel then fails to start with resolvconf: command not found, install openresolv (or use systemd-resolved), or remove the line.
Remove it
sudo systemctl disable --now wg-quick@pbgw
sudo rm /etc/wireguard/pbgw.conf
Related
Still stuck? Open a ticket — tell us what was missing and the article gets fixed.