/commands/wireguard/start-wireguard-on-boot
systemctl enable --now wg-quick@wg0: start WireGuard at boot
- tool
- WireGuard
- versions
- wireguard-tools 1.0, systemd
- os
- linux
sudo systemctl enable --now wg-quick@wg0 makes systemd bring up the tunnel defined in /etc/wireguard/wg0.conf at every boot and starts it right away. The wg-quick@.service template ships with wireguard-tools; the part after @ is the configuration name, so wg-quick@office reads /etc/wireguard/office.conf. Check it with systemctl status wg-quick@wg0 and sudo wg show.
Enable, check, disable
sudo systemctl enable --now wg-quick@wg0 # start now and at every boot
systemctl status wg-quick@wg0 # active (exited) is the normal state
sudo wg show wg0 # peers and latest handshake
journalctl -u wg-quick@wg0 -b # the wg-quick commands and errors of this boot
sudo systemctl restart wg-quick@wg0 # after editing Address, DNS, MTU or PostUp
sudo systemctl reload wg-quick@wg0 # after editing peers: no interruption
sudo systemctl disable --now wg-quick@wg0 # stop and remove from bootThe unit is a Type=oneshot service with RemainAfterExit=yes: it runs wg-quick up wg0 once and then shows active (exited), which is not an error. Stopping it runs wg-quick down wg0.
What the unit does
| Unit setting | Value in wg-quick@.service | Effect |
|---|---|---|
| ExecStart | /usr/bin/wg-quick up %i | Creates the interface, sets addresses, routes and DNS. |
| ExecStop | /usr/bin/wg-quick down %i | Removes the interface and its routes. |
| ExecReload | wg syncconf %i with wg-quick strip %i | Applies peer and key changes without dropping sessions. |
| After / Wants | network-online.target nss-lookup.target | Waits for the network and DNS, so Endpoint host names resolve. |
| Environment | WG_ENDPOINT_RESOLUTION_RETRIES=infinity | Keeps retrying Endpoint name resolution at boot instead of failing. |
| WantedBy | multi-user.target wg-quick.target | Started in normal boots; wg-quick.target groups all tunnels. |
Pitfalls
- Bring a tunnel up either by hand or through systemd, not both. A tunnel started with
wg-quick upmakes the service fail with wg0 already exists. DNS =in the file needsresolvconf; without it the start fails with resolvconf: command not found.- wg-quick warns when the file is readable by other users; set
chmod 600 /etc/wireguard/wg0.conf(world accessible). - With
SaveConfig = true, stopping the service writes the running state back to the file, overwriting edits you made while it was up. Stop the service before editing, or leave SaveConfig off.
On distributions without systemd, run wg-quick up wg0 from the init system's own boot scripts.
FAQ
Can I enable several tunnels?
Yes. Each configuration file gets its own instance: systemctl enable --now wg-quick@wg0 wg-quick@wg1. The instance name is the file name without .conf.
Does systemctl reload apply a change to Address or DNS?
No. The reload runs wg syncconf with the output of wg-quick strip, which removes wg-quick options such as Address, DNS, MTU and the PostUp scripts. Changes to those need systemctl restart wg-quick@wg0.
The service fails with wg0 already exists. Why?
The interface was already brought up by hand with wg-quick up. Run sudo wg-quick down wg0 once, then start the service so systemd owns the interface.