One-Click WireGuard for Ubuntu 24.04 / 26.04 LTS

A single Bash script that installs and manages a WireGuard IPv4 server on Ubuntu 24.04 and 26.04 LTS. It provides peer allocation, preshared keys, mobile-client QR output, scoped NAT, forwarding, and MTU clamping.

Install v1.1.0

Downloading and inspecting the script before running it as root is recommended:

curl -fsSLo wg.sh https://git.leafwolf.net/HalfVulpes/OneClickWireguard/raw/tag/v1.1.0/wg.sh
bash -n wg.sh
chmod 0755 wg.sh
sudo ./wg.sh install

With wget:

wget -qO wg.sh https://git.leafwolf.net/HalfVulpes/OneClickWireguard/raw/tag/v1.1.0/wg.sh
bash -n wg.sh
chmod 0755 wg.sh
sudo ./wg.sh install

Upgrade an existing installation

Download v1.1.0 as shown above, then migrate the existing server:

sudo ./wg.sh upgrade

upgrade validates the existing state, backs up the server configuration, removes the previous broad firewall rules by taking the managed interface down, writes subnet-scoped idempotent rules, and brings the interface back up. A running VPN has a brief interruption during this operation. If the new config does not start, the previous config is restored.

Older releases changed DEFAULT_FORWARD_POLICY in /etc/default/ufw to ACCEPT. v1.1.0 no longer changes that global policy, but it cannot safely guess whether an existing ACCEPT value was selected by an administrator. Review that file after upgrading and restore your intended UFW policy.

Commands

sudo ./wg.sh install
sudo ./wg.sh upgrade
sudo ./wg.sh add-user
sudo ./wg.sh list
sudo ./wg.sh show-qr alice
sudo ./wg.sh remove-user alice
sudo ./wg.sh check-update
./wg.sh version

reinstall is deliberately destructive: after an exact yes confirmation it stops WireGuard interfaces and wipes /etc/wireguard.

Behavior

• Installs WireGuard tools, qrencode, iproute2, iptables, curl, and util-linux.
• Enables persistent IPv4 forwarding.
• Creates a /24 WireGuard network and allocates unique peer /32 addresses.
• Limits masquerading to the selected VPN subnet and WAN interface.
• Makes generated iptables rules idempotent and limits MSS clamping to traffic entering the WireGuard interface.
• Adds a scoped UFW route rule when UFW is active without weakening the global forwarding policy.
• Stores private keys and state under /etc/wireguard with restrictive permissions.
• Applies peer changes transactionally and restores the previous server config when a live update fails.

Client configurations are stored at:

/etc/wireguard/peers/<username>/<username>.conf

Update checks

Each on-disk invocation performs a cached, five-second update check against the LeafWolf Forgejo master branch. It downloads at most 1 MiB over HTTPS, validates Bash syntax, compares the exact file hash, and never executes or automatically installs the response.

WG_NO_UPDATE_CHECK=1 sudo ./wg.sh list
WG_REPO_RAW=https://forgejo.example/owner/repo/raw/branch/master/wg.sh sudo ./wg.sh check-update

Only HTTPS update URLs are accepted. The cache is /etc/wireguard/.last-update-check and expires after six hours.

Local verification

This project intentionally has no hosted Actions workflow. Run the local checks with:

bash -n wg.sh tests/test_wg.sh
shellcheck -x wg.sh tests/test_wg.sh
bash tests/test_wg.sh

Security notes

• Run the manager as root only after reviewing it.
• The state file is parsed as data and validated; it is never sourced as shell code.
• Interface names, endpoints, addresses, ports, DNS values, and usernames are validated before they reach files, commands, or paths.
• Peer configuration files contain private keys. Protect backups and do not publish them.