{"id":4955,"date":"2026-09-15T08:00:00","date_gmt":"2026-09-15T08:00:00","guid":{"rendered":"https:\/\/netguide.io\/linux\/?p=4955"},"modified":"2026-08-10T23:46:01","modified_gmt":"2026-08-10T23:46:01","slug":"wireguard-vpn-einrichten-linux","status":"publish","type":"post","link":"https:\/\/netguide.io\/linux\/de\/wireguard-vpn-einrichten-linux\/","title":{"rendered":"WireGuard VPN einrichten unter Linux \u2013 Anleitung"},"content":{"rendered":"<script type=\"text\/plain\" data-tcf=\"waiting-for-consent\" data-id=\"4797\" data-bid=\"2\" data-placement=\"4798\">PGRpdiBpZD0ibmV0Z3VpZGVhLTEwNzU3NjU4MDYiIGNsYXNzPSJuZXRndWlkZWEtYmVmb3JlLWNvbnRlbnQgbmV0Z3VpZGVhLWVudGl0eS1wbGFjZW1lbnQiPjxkaXYgY2xhc3M9Im5ldGd1aWRlYS1hZGxhYmVsIj5BZHZlcnRpc2VtZW50czwvZGl2PjxzY3JpcHQgYXN5bmMgc3JjPSIvL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9qcy9hZHNieWdvb2dsZS5qcz9jbGllbnQ9Y2EtcHViLTYyNTg1NTYyNTcyNDU5OTgiIGNyb3Nzb3JpZ2luPSJhbm9ueW1vdXMiPjwvc2NyaXB0PjxpbnMgY2xhc3M9ImFkc2J5Z29vZ2xlIiBzdHlsZT0iZGlzcGxheTpibG9jazsiIGRhdGEtYWQtY2xpZW50PSJjYS1wdWItNjI1ODU1NjI1NzI0NTk5OCIgCmRhdGEtYWQtc2xvdD0iMzQ5NDExNTM0MiIgCmRhdGEtYWQtZm9ybWF0PSJhdXRvIj48L2lucz4KPHNjcmlwdD4gCihhZHNieWdvb2dsZSA9IHdpbmRvdy5hZHNieWdvb2dsZSB8fCBbXSkucHVzaCh7fSk7IAo8L3NjcmlwdD4KPC9kaXY+<\/script>\n<p class=\"wp-block-paragraph\">Ein eigenes VPN klingt kompliziert? Mit WireGuard ist es das nicht mehr. Das moderne VPN-Protokoll ist schlank, extrem schnell und in wenigen Minuten eingerichtet. In dieser Anleitung zeigen wir dir, wie du ein <strong>WireGuard VPN unter Linux einrichtest<\/strong> \u2013 vom Schl\u00fcsselpaar \u00fcber die Server-Konfiguration bis zum ersten Client.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Egal ob du ein <strong>WireGuard VPN<\/strong> f\u00fcr den sicheren Fernzugriff auf dein Heimnetz, f\u00fcr verschl\u00fcsselte Verbindungen im offenen WLAN oder als schlanke Alternative zu OpenVPN nutzen willst \u2013 das Prinzip bleibt gleich. Wir gehen die Einrichtung Schritt f\u00fcr Schritt durch und schauen anschlie\u00dfend auf Client-Konfiguration, Sicherheit, Performance und typische Stolperfallen, damit dein Tunnel dauerhaft stabil l\u00e4uft.<\/p>\n\n\n\t\t\t\t<div class=\"wp-block-uagb-table-of-contents uagb-toc__align-left uagb-toc__columns-1  uagb-block-1ffd1ad5      \"\n\t\t\t\t\tdata-scroll= \"1\"\n\t\t\t\t\tdata-offset= \"30\"\n\t\t\t\t\tstyle=\"\"\n\t\t\t\t>\n\t\t\t\t<div class=\"uagb-toc__wrap\">\n\t\t\t\t\t\t<div class=\"uagb-toc__title\">\n\t\t\t\t\t\t\tInhaltsverzeichnis\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<div class=\"uagb-toc__list-wrap \">\n\t\t\t\t\t\t<ol class=\"uagb-toc__list\"><li class=\"uagb-toc__list\"><a href=\"#warum-wireguard\" class=\"uagb-toc-link__trigger\">Warum WireGuard?<\/a><li class=\"uagb-toc__list\"><a href=\"#schritt-1-wireguard-installieren\" class=\"uagb-toc-link__trigger\">Schritt 1: WireGuard installieren<\/a><li class=\"uagb-toc__list\"><a href=\"#schritt-2-schl\u00fcsselpaar-erzeugen\" class=\"uagb-toc-link__trigger\">Schritt 2: Schl\u00fcsselpaar erzeugen<\/a><li class=\"uagb-toc__list\"><a href=\"#schritt-3-server-konfigurieren\" class=\"uagb-toc-link__trigger\">Schritt 3: Server konfigurieren<\/a><li class=\"uagb-toc__list\"><a href=\"#schritt-4-ip-weiterleitung-aktivieren\" class=\"uagb-toc-link__trigger\">Schritt 4: IP-Weiterleitung aktivieren<\/a><li class=\"uagb-toc__list\"><a href=\"#schritt-5-tunnel-starten-und-aktivieren\" class=\"uagb-toc-link__trigger\">Schritt 5: Tunnel starten und aktivieren<\/a><li class=\"uagb-toc__list\"><a href=\"#firewall-port-freigeben\" class=\"uagb-toc-link__trigger\">Firewall-Port freigeben<\/a><li class=\"uagb-toc__list\"><a href=\"#wireguard-im-vergleich-zu-openvpn-und-ipsec\" class=\"uagb-toc-link__trigger\">WireGuard im Vergleich zu OpenVPN und IPsec<\/a><li class=\"uagb-toc__list\"><a href=\"#den-client-einrichten-und-split-tunneling-nutzen\" class=\"uagb-toc-link__trigger\">Den Client einrichten und Split Tunneling nutzen<\/a><li class=\"uagb-toc__list\"><a href=\"#sicherheit-und-performance-optimieren\" class=\"uagb-toc-link__trigger\">Sicherheit und Performance optimieren<\/a><li class=\"uagb-toc__list\"><a href=\"#h\u00e4ufige-fragen\" class=\"uagb-toc-link__trigger\">H\u00e4ufige Fragen<\/a><li class=\"uagb-toc__list\"><a href=\"#wie-f\u00fcge-ich-weitere-clients-hinzu\" class=\"uagb-toc-link__trigger\">Wie f\u00fcge ich weitere Clients hinzu?<\/a><li class=\"uagb-toc__list\"><a href=\"#warum-baut-der-tunnel-keine-verbindung-auf\" class=\"uagb-toc-link__trigger\">Warum baut der Tunnel keine Verbindung auf?<\/a><li class=\"uagb-toc__list\"><a href=\"#ist-wireguard-sicher-genug-f\u00fcr-sensible-daten\" class=\"uagb-toc-link__trigger\">Ist WireGuard sicher genug f\u00fcr sensible Daten?<\/a><li class=\"uagb-toc__list\"><a href=\"#fazit\" class=\"uagb-toc-link__trigger\">Fazit<\/a><\/ol>\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Warum WireGuard?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">WireGuard ist deutlich einfacher konfiguriert als klassische L\u00f6sungen wie OpenVPN, dabei schneller und mit modernster Verschl\u00fcsselung. Es ist seit Jahren fester Bestandteil des Linux-Kernels. Ideal, um von unterwegs sicher auf dein Heimnetz oder deinen Server zuzugreifen.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Schritt 1: WireGuard installieren<\/h3>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>sudo apt update\nsudo apt install -y wireguard<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color: #24292e\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #B392F0\">sudo<\/span><span style=\"color: #9ECBFF\"> apt<\/span><span style=\"color: #9ECBFF\"> update<\/span><\/span>\n<span class=\"line\"><span style=\"color: #B392F0\">sudo<\/span><span style=\"color: #9ECBFF\"> apt<\/span><span style=\"color: #9ECBFF\"> install<\/span><span style=\"color: #79B8FF\"> -y<\/span><span style=\"color: #9ECBFF\"> wireguard<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Schritt 2: Schl\u00fcsselpaar erzeugen<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">WireGuard arbeitet mit einem privaten und einem \u00f6ffentlichen Schl\u00fcssel. Erzeuge sie f\u00fcr den Server:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>wg genkey | sudo tee \/etc\/wireguard\/privatekey | wg pubkey | sudo tee \/etc\/wireguard\/publickey<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color: #24292e\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #B392F0\">wg<\/span><span style=\"color: #9ECBFF\"> genkey<\/span><span style=\"color: #F97583\"> |<\/span><span style=\"color: #B392F0\"> sudo<\/span><span style=\"color: #9ECBFF\"> tee<\/span><span style=\"color: #9ECBFF\"> \/etc\/wireguard\/privatekey<\/span><span style=\"color: #F97583\"> |<\/span><span style=\"color: #B392F0\"> wg<\/span><span style=\"color: #9ECBFF\"> pubkey<\/span><span style=\"color: #F97583\"> |<\/span><span style=\"color: #B392F0\"> sudo<\/span><span style=\"color: #9ECBFF\"> tee<\/span><span style=\"color: #9ECBFF\"> \/etc\/wireguard\/publickey<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Schritt 3: Server konfigurieren<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Lege die Konfigurationsdatei <code>\/etc\/wireguard\/wg0.conf<\/code> an. Sie definiert die Server-Adresse im VPN, den Port und den ersten Client als \u201ePeer&#8221;:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>[Interface]\nAddress = 10.0.0.1\/24\nListenPort = 51820\nPrivateKey = DEIN_SERVER_PRIVATE_KEY\n\n[Peer]\nPublicKey = CLIENT_PUBLIC_KEY\nAllowedIPs = 10.0.0.2\/32<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color: #24292e\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #B392F0\">[Interface]<\/span><\/span>\n<span class=\"line\"><span style=\"color: #F97583\">Address<\/span><span style=\"color: #E1E4E8\"> = 10.0.0.1\/24<\/span><\/span>\n<span class=\"line\"><span style=\"color: #F97583\">ListenPort<\/span><span style=\"color: #E1E4E8\"> = 51820<\/span><\/span>\n<span class=\"line\"><span style=\"color: #F97583\">PrivateKey<\/span><span style=\"color: #E1E4E8\"> = DEIN_SERVER_PRIVATE_KEY<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #B392F0\">[Peer]<\/span><\/span>\n<span class=\"line\"><span style=\"color: #F97583\">PublicKey<\/span><span style=\"color: #E1E4E8\"> = CLIENT_PUBLIC_KEY<\/span><\/span>\n<span class=\"line\"><span style=\"color: #F97583\">AllowedIPs<\/span><span style=\"color: #E1E4E8\"> = 10.0.0.2\/32<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Schritt 4: IP-Weiterleitung aktivieren<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Damit der Server Datenverkehr weiterleiten darf, aktivierst du IP-Forwarding dauerhaft:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>echo \"net.ipv4.ip_forward=1\" | sudo tee \/etc\/sysctl.d\/99-wireguard.conf\nsudo sysctl -p \/etc\/sysctl.d\/99-wireguard.conf<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color: #24292e\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #79B8FF\">echo<\/span><span style=\"color: #9ECBFF\"> \"net.ipv4.ip_forward=1\"<\/span><span style=\"color: #F97583\"> |<\/span><span style=\"color: #B392F0\"> sudo<\/span><span style=\"color: #9ECBFF\"> tee<\/span><span style=\"color: #9ECBFF\"> \/etc\/sysctl.d\/99-wireguard.conf<\/span><\/span>\n<span class=\"line\"><span style=\"color: #B392F0\">sudo<\/span><span style=\"color: #9ECBFF\"> sysctl<\/span><span style=\"color: #79B8FF\"> -p<\/span><span style=\"color: #9ECBFF\"> \/etc\/sysctl.d\/99-wireguard.conf<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Schritt 5: Tunnel starten und aktivieren<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Starte die Verbindung mit <code>wg-quick<\/code> und aktiviere den Autostart \u00fcber systemd:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>sudo wg-quick up wg0\nsudo systemctl enable wg-quick@wg0<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color: #24292e\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #B392F0\">sudo<\/span><span style=\"color: #9ECBFF\"> wg-quick<\/span><span style=\"color: #9ECBFF\"> up<\/span><span style=\"color: #9ECBFF\"> wg0<\/span><\/span>\n<span class=\"line\"><span style=\"color: #B392F0\">sudo<\/span><span style=\"color: #9ECBFF\"> systemctl<\/span><span style=\"color: #9ECBFF\"> enable<\/span><span style=\"color: #9ECBFF\"> wg-quick@wg0<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Den Status des Tunnels pr\u00fcfst du jederzeit mit <code>sudo wg show<\/code>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Firewall-Port freigeben<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Nicht vergessen: Der UDP-Port 51820 muss in der Firewall offen sein. Mit <a href=\"https:\/\/netguide.io\/linux\/de\/ufw-firewall-einrichten-linux\/\">UFW<\/a> geht das schnell:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>sudo ufw allow 51820\/udp<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color: #24292e\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #B392F0\">sudo<\/span><span style=\"color: #9ECBFF\"> ufw<\/span><span style=\"color: #9ECBFF\"> allow<\/span><span style=\"color: #9ECBFF\"> 51820\/udp<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">WireGuard im Vergleich zu OpenVPN und IPsec<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Warum \u00fcberhaupt WireGuard und nicht das altbekannte OpenVPN? Der gr\u00f6\u00dfte Unterschied liegt in der Schlankheit: WireGuard besteht aus wenigen tausend Zeilen Code, w\u00e4hrend OpenVPN und IPsec \u00fcber hunderttausende Zeilen mitbringen. Weniger Code bedeutet eine kleinere Angriffsfl\u00e4che und einfachere Pr\u00fcfbarkeit. Dazu kommt die deutlich h\u00f6here Geschwindigkeit, weil WireGuard direkt im Kernel arbeitet und moderne Kryptografie (Curve25519, ChaCha20, Poly1305) fest verdrahtet nutzt.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Merkmal<\/th><th>WireGuard<\/th><th>OpenVPN<\/th><\/tr><\/thead><tbody><tr><td>Protokoll<\/td><td>UDP<\/td><td>UDP oder TCP<\/td><\/tr><tr><td>Geschwindigkeit<\/td><td>Sehr hoch<\/td><td>Mittel<\/td><\/tr><tr><td>Konfiguration<\/td><td>Wenige Zeilen<\/td><td>Umfangreich<\/td><\/tr><tr><td>Verschl\u00fcsselung<\/td><td>Fest (modern)<\/td><td>W\u00e4hlbar<\/td><\/tr><tr><td>Reconnect<\/td><td>Nahtlos (Roaming)<\/td><td>Langsamer<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">F\u00fcr die meisten Selfhosting-Szenarien ist WireGuard die bessere Wahl. Nur wenn du zwingend TCP auf Port 443 tunneln musst, um restriktive Firewalls zu umgehen, spielt OpenVPN seine St\u00e4rke aus.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Den Client einrichten und Split Tunneling nutzen<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Auf der Client-Seite erzeugst du analog zum Server ein Schl\u00fcsselpaar und legst eine eigene Konfigurationsdatei an. Entscheidend ist der Wert <code>AllowedIPs<\/code>: Tr\u00e4gst du <code>0.0.0.0\/0, ::\/0<\/code> ein, l\u00e4uft dein gesamter Datenverkehr durch den Tunnel (Full Tunnel) \u2013 ideal im \u00f6ffentlichen WLAN. Gibst du dagegen nur dein Heimnetz wie <code>10.0.0.0\/24, 192.168.1.0\/24<\/code> an, wird nur dieser Verkehr getunnelt (Split Tunnel), w\u00e4hrend normales Surfen direkt l\u00e4uft.<\/p><p>Steht der Server hinter einem NAT oder wechselt die IP, hilft <code>PersistentKeepalive = 25<\/code>, damit die Verbindung nicht einschl\u00e4ft. Den \u00f6ffentlichen Server-Schl\u00fcssel und die Endpoint-Adresse tr\u00e4gst du im <code>[Peer]<\/code>-Block des Clients ein.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Full Tunnel:<\/strong> <code>AllowedIPs = 0.0.0.0\/0, ::\/0<\/code> \u2013 maximaler Schutz unterwegs<\/li>\n\n<li><strong>Split Tunnel:<\/strong> nur interne Netze angeben \u2013 spart Bandbreite<\/li>\n\n<li><strong>PersistentKeepalive:<\/strong> h\u00e4lt NAT-Mappings offen, wichtig hinter Routern<\/li>\n\n<li><strong>Endpoint:<\/strong> \u00f6ffentliche IP oder DynDNS-Domain plus <code>:51820<\/code><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Sicherheit und Performance optimieren<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">WireGuard ist von Haus aus sicher, ein paar Best Practices erh\u00f6hen die Robustheit aber deutlich. Setze die Dateirechte der privaten Schl\u00fcssel restriktiv mit <code>sudo chmod 600 \/etc\/wireguard\/privatekey<\/code>, damit kein anderer Nutzer sie lesen kann. F\u00fcr zus\u00e4tzlichen Schutz kannst du pro Peer einen Preshared Key \u00fcber <code>wg genpsk<\/code> erzeugen und als <code>PresharedKey<\/code> hinterlegen \u2013 das sch\u00fctzt zus\u00e4tzlich gegen zuk\u00fcnftige Quantenangriffe.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Bei der Performance lohnt ein Blick auf die MTU: Kommt es zu Verbindungsabbr\u00fcchen bei gro\u00dfen Paketen, hilft oft ein niedrigerer Wert wie <code>MTU = 1420<\/code> im <code>[Interface]<\/code>-Block. Den aktuellen Status inklusive letztem Handshake und \u00fcbertragenem Volumen zeigt dir <code>sudo wg show<\/code> jederzeit an.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Soll der gesamte Client-Verkehr \u00fcber den Server ins Internet geleitet werden, brauchst du auf dem Server zus\u00e4tzlich eine NAT-Regel, die die Pakete maskiert \u2013 etwa \u00fcber <code>iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE<\/code>. Praktisch l\u00e4sst sich das direkt in der <code>wg0.conf<\/code> \u00fcber die Zeilen <code>PostUp<\/code> und <code>PostDown<\/code> hinterlegen, sodass die Regel automatisch mit dem Tunnel kommt und wieder verschwindet. Achte au\u00dferdem darauf, im Client einen erreichbaren DNS-Server zu setzen, damit die Namensaufl\u00f6sung im Full-Tunnel-Betrieb nicht ins Leere l\u00e4uft.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">H\u00e4ufige Fragen<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">Wie f\u00fcge ich weitere Clients hinzu?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Erzeuge f\u00fcr jeden Client ein eigenes Schl\u00fcsselpaar und erg\u00e4nze in der <code>wg0.conf<\/code> des Servers einen weiteren <code>[Peer]<\/code>-Block mit dessen \u00f6ffentlichem Schl\u00fcssel und einer eindeutigen <code>AllowedIPs<\/code>-Adresse (z. B. <code>10.0.0.3\/32<\/code>). Danach l\u00e4dst du die Konfiguration mit <code>sudo wg syncconf wg0 &lt;(wg-quick strip wg0)<\/code> neu, ohne den Tunnel zu trennen.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Warum baut der Tunnel keine Verbindung auf?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In den meisten F\u00e4llen ist der UDP-Port nicht freigegeben oder es fehlt eine Portweiterleitung im Router. Pr\u00fcfe die Firewall, kontrolliere mit <code>sudo wg show<\/code>, ob ein Handshake zustande kommt, und stelle sicher, dass die \u00f6ffentlichen Schl\u00fcssel auf beiden Seiten korrekt vertauscht wurden.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Ist WireGuard sicher genug f\u00fcr sensible Daten?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Ja. WireGuard nutzt ausschlie\u00dflich moderne, gepr\u00fcfte Kryptografie und ist fester Bestandteil des Linux-Kernels. In Kombination mit restriktiven Dateirechten und optionalem Preshared Key eignet es sich problemlos f\u00fcr den Zugriff auf sensible Dienste im Heimnetz.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Fazit<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">WireGuard bringt dir ein schnelles, sicheres VPN mit erstaunlich wenig Konfiguration: Schl\u00fcssel erzeugen, <code>wg0.conf<\/code> anlegen, Tunnel starten \u2013 fertig. F\u00fcr jeden weiteren Client erg\u00e4nzt du einfach einen weiteren <code>[Peer]<\/code>-Block. Ein VPN ist ein zentraler Baustein f\u00fcr sicheres <a href=\"https:\/\/netguide.io\/linux\/de\/5-grunde-furs-selfhosting\/\">Selfhosting<\/a> und erg\u00e4nzt einen <a href=\"https:\/\/netguide.io\/linux\/de\/ssh-server-absichern\/\">geh\u00e4rteten SSH-Zugang<\/a> ideal.<\/p>\n<script type=\"text\/plain\" data-tcf=\"waiting-for-consent\" data-id=\"4799\" data-bid=\"2\" data-placement=\"4800\">PGRpdiBpZD0ibmV0Z3VpZGVhLTI0NTM4NDIzOTgiIGNsYXNzPSJuZXRndWlkZWEtYWZ0ZXItY29udGVudCBuZXRndWlkZWEtZW50aXR5LXBsYWNlbWVudCI+PGRpdiBjbGFzcz0ibmV0Z3VpZGVhLWFkbGFiZWwiPkFkdmVydGlzZW1lbnRzPC9kaXY+PHNjcmlwdCBhc3luYyBzcmM9Ii8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2pzL2Fkc2J5Z29vZ2xlLmpzP2NsaWVudD1jYS1wdWItNjI1ODU1NjI1NzI0NTk5OCIgY3Jvc3NvcmlnaW49ImFub255bW91cyI+PC9zY3JpcHQ+PGlucyBjbGFzcz0iYWRzYnlnb29nbGUiIHN0eWxlPSJkaXNwbGF5OmJsb2NrOyIgZGF0YS1hZC1jbGllbnQ9ImNhLXB1Yi02MjU4NTU2MjU3MjQ1OTk4IiAKZGF0YS1hZC1zbG90PSI0NTU5Nzg1MDAyIiAKZGF0YS1hZC1mb3JtYXQ9ImF1dG8iPjwvaW5zPgo8c2NyaXB0PiAKKGFkc2J5Z29vZ2xlID0gd2luZG93LmFkc2J5Z29vZ2xlIHx8IFtdKS5wdXNoKHt9KTsgCjwvc2NyaXB0Pgo8L2Rpdj4=<\/script>","protected":false},"excerpt":{"rendered":"<p>WireGuard VPN unter Linux einrichten: Schl\u00fcssel erzeugen, Server- und Client-Konfiguration anlegen, den Tunnel starten und dauerhaft aktivieren.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[9],"tags":[],"class_list":["post-4955","post","type-post","status-publish","format-standard","hentry","category-linux"],"uagb_featured_image_src":{"full":false,"thumbnail":false,"medium":false,"medium_large":false,"large":false,"1536x1536":false,"2048x2048":false},"uagb_author_info":{"display_name":"Tobias","author_link":"https:\/\/netguide.io\/linux\/author\/tobias-pries\/"},"uagb_comment_info":0,"uagb_excerpt":"WireGuard VPN unter Linux einrichten: Schl\u00fcssel erzeugen, Server- und Client-Konfiguration anlegen, den Tunnel starten und dauerhaft aktivieren.","brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/posts\/4955","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/comments?post=4955"}],"version-history":[{"count":2,"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/posts\/4955\/revisions"}],"predecessor-version":[{"id":4987,"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/posts\/4955\/revisions\/4987"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/media?parent=4955"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/categories?post=4955"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/tags?post=4955"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}