So far I have installed WireGuard "servers" on a few single-board computers including the Raspberry Pi 1 Model B, the Raspberry Pi 3 Model B running the Stretch and Buster versions Raspbian. I have also installed WireGuard "clients" on a couple of Android tablets, a recent low-end Android phone and on an old portable computer running Linux Mint 19. After a few false starts, I must admit that installation is not difficult especially as there is good information available on the Web. In this post I will give details about installing WireGuard on any Raspberry Pi 2 (version 1.2) and above running either Raspbian Stretch or newly released Raspbian Buster.

Table of Contents

1. Prerequisites to Installing WireGuard on a Raspberry Pi 2 v1.2 or above
2. Installing WireGuard on Raspbian Stretch
3. Installing WireGuard on Raspbian Buster
4. The Dietpi Script to Install WireGuard on Raspbian Stretch or Buster
5. Configuring WireGuard
6. Installing WireGuard on Other Devices

Prequisites to Installing WireGuard on a Raspberry Pi 2 v1.2 or above

I will describe how to install the WireGuard virtual network server on a Raspberry Pi 3 model B running Raspbian Stretch Lite and Raspbian Buster Lite. These are the versions on which the software has been installed.

Raspbian Stretch Lite
  Minimal image based on Debian Stretch
  Version:        April 2019
  Release date:   2019-04-08
  Kernel version: 4.14

Raspbian Buster Lite
  Minimal image based on Debian Buster

  Version:        June 2019
  Release date:   2019-06-20
  Kernel version: 4.19

  Version:        February 2020
  Release date:   2020-02-13
  Kernel version: 4.19

Unless you have a new Raspberry Pi 4, I don't think there is a pressing need to use the newly available Raspbian Buster and it might be a good idea to wait before switching to the new release. The latest version of Raspbian is always available from the Raspberry Pi Foundation Raspbian downloads page. Since Stretch is not the latest release of Raspbian, it is no longer available from that page. Nevertheless it can be downloaded along with older versions of Buster.

• All Raspberry Pi Foundation downloads: http://downloads.raspberrypi.org/
• All Raspbian Lite images: http://downloads.raspberrypi.org/raspbian_lite/images/
• Raspbian Stretch Lite 2019-04-09: http://downloads.raspberrypi.org/raspbian_lite/images/raspbian_lite-2019-04-09/2019-04-08-raspbian-stretch-lite.zip

Full versions of Raspbian Stretch or Buster are also available if that is the preferred OS. Even if the GUI version is installed, it will be necessary to open a terminal to install WireGuard.

If a newer version of Raspbian is used, then WireGuard may already be installed. Test as explained in the leading sidebar.

If the two programs are found, WireGuard is installed and only needs to be configured. Otherwise the following steps must be performed beginning with a system update and the installation of the Linux kernel headers.

This process is lengthy. Note that in the latest version (Feb. 2020) of Buster it is version 1.20200212-1 of the kernel headers that is installed and that it is considerably bigger package.

That is it for the prerequisites in Raspbian Buster. In Stretch the dirmngr utility that performs network operations when managing and downloading certificates when accessing Debian repositories needs to be installed.

This is an older version compared to version 2.2.12 present in Buster by default, but that does not seem to matter.

Installing WireGuard in Raspbian Stretch

Let's continue following the very clear instructions provided by Adrian Mihalko on GitHub.

Note the two warnings about the unsigned unstable repository. That is why it is necessary to confirm twice to proceed when installing WireGuard. If the -y option had been specified, the installation would have failed as shown below.

According to the error message, the following would have worked, but I did not test that.

It is important to create the limit-unstable file in the /etc/apt/preferences.d. That file was created in the command starting with printf 'Package:. If that is not done, then an apt-get upgrade will replace many, many packages from the stable Stretch repository with unstable versions from the unstable repository with perhaps dire consequences. This can be checked by running apt-get update just before creating the limit-unstable file.

Now that the installation of WireGuard in Stretch is complete jump to configuring WireGuard.

Installing WireGuard in Raspbian Buster

Wireguard can be installed in Buster following the instructions from Adrian Mihalko with the updated archive key from Ryan Govostes (Feb 10, 2020).

The Dietpi Script to Install WireGuard on Raspbian Stretch or Buster

As discussed in the original version of this post, the Dietpi crew created a script to install WireGuard. It is found in their "experimental Buster image" for the Raspberry Pi but it also works in Stretch. I looked at issue #2458 WireGuard: Prevent accidental "sid" repo installs and the software installation script to obtain the information that follows. As before, the prerequisites as discussed in the first section above need to be installed.

The installation is complete.

Configuring WireGuard

Once WireGuard is installed, it cannot yet be used. The local area network must be made accessible from the outside, WireGuard must be configured and clients or peers must be created to use the self hosted VPN. Details for all this can be found in section 3 and on of the newer version of this post: Installing and Configuring WireGuard on Raspbian Buster.

Installing WireGuard on Other Devices

On older Raspberry Pi models it is necessary to compile WireGuard from the source code. Again, I followed Adrian Mihalko detailed instructions to install the software correctly on a Raspberry Pi 1. I was surprised that the VPN performed adequately even when routing all Internet traffic through it in a coffee shop for better security. My bandwidth demands were usually relatively light. Nevertheless, I streamed YouTube videos simultaneously on a tablet and portable without noticeable degradation. Of course these were not 4K videos, but then I have no plans to view high-definition videos in coffee shops in the forseeable future.

Not long after installing WireGuard on the older Raspberry Pi, I did the same on an Orange Pi Zero with an older version of Armbian. It was necessary to compile the source code much in the same way as on the older Raspberry Pi, but there was a bit of a struggle to get the prerequisite packages in place. There is no point in pursuing this any further given that the latest version of Armbian Bionic includes WireGuard.

The fact that WireGuard is now part of the Linux kernel will only hasten its adoption by an ever-growing number of users. In my opinion, that is a good thing as I have found that using it to host a VPN is very reliable, useful and surprisingly seamless. I suspect that soon installation will no longer be a barrier even on Rasbian, and there will be no real argument against at least giving it a try.