Skip to content
Browse

/errors/wireguard/resolvconf-command-not-found

wg-quick: resolvconf: command not found

The commands on this page have not been executed by our verification runner yet.updated
tool
WireGuard
exit code
127
versions
wireguard-tools 1.0, wg-quick (Linux)
os
linux

resolvconf: command not found from wg-quick up means your WireGuard configuration has a DNS = line, and wg-quick tries to apply it by running resolvconf, which is not installed. The interface itself was created, but wg-quick then removes it again because the command failed. Install a resolvconf implementation (on systemd-resolved systems, the systemd-resolved package's compatibility command or openresolv), or remove the DNS = line and configure DNS with resolvectl in PostUp.

What it looks like

text
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.0.0.2/24 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a wg0 -m 0 -x
/usr/bin/wg-quick: line 32: resolvconf: command not found
[#] ip link delete dev wg0

The line number in the message depends on the wg-quick version. [#] lines are the commands wg-quick runs.

Fix 1: provide resolvconf

bash
# Debian 12+: the systemd-resolved package ships a resolvconf command
sudo apt install systemd-resolved
# or a standalone implementation
sudo apt install openresolv        # Debian/Ubuntu
sudo dnf install openresolv        # Fedora (if available in your repositories)
command -v resolvconf
sudo wg-quick up wg0

Fix 2: no DNS line, use resolvectl

ini
[Interface]
PrivateKey = ...
Address = 10.0.0.2/24
PostUp = resolvectl dns %i 10.0.0.1; resolvectl domain %i "~."

%i is replaced by the interface name. The ~. routing domain sends all queries to the VPN's DNS server; leave it out to use the VPN DNS only for its own domains. The settings disappear with the interface, so no PostDown is needed.

Check DNS after connecting

bash
resolvectl status wg0
resolvectl query example.com

NetworkManager users can import the file instead (nmcli connection import type wireguard file /etc/wireguard/wg0.conf), which handles DNS without resolvconf.

Sources

Related pages

errors · wireguardwg-quick: RTNETLINK answers: Operation not supported (ip link add wg0 type wireguard)ip link add wg0 type wireguard fails when the kernel lacks the WireGuard module. Load it with modprobe, reboot after a kernel update, or use wireguard-go.config · wireguardWireGuard AllowedIPs: routing and peer filtering explainedWireGuard AllowedIPs lists the addresses a peer may send from and the routes sent to it. 0.0.0.0/0, ::/0 routes all traffic; a /32 per peer limits it to one IP.config · wireguardWireGuard PersistentKeepalive = 25: keep a tunnel open behind NATPersistentKeepalive = 25 sends a WireGuard packet every 25 seconds so NAT keeps the tunnel reachable. Set it on the peer behind NAT; servers rarely need it.commands · wireguardwg genkey | tee privatekey | wg pubkey > publickey: generate WireGuard keyswg genkey | tee privatekey | wg pubkey > publickey creates a WireGuard key pair. Set umask 077 first, and add a pre-shared key with wg genpsk if needed.