wg-quick: RTNETLINK answers: Operation not supported (ip link add wg0 type wireguard)

RTNETLINK answers: Operation not supported right after [#] ip link add wg0 type wireguard means the kernel does not know the wireguard interface type: the WireGuard module is not loaded and cannot be loaded. Load it with sudo modprobe wireguard; if that fails, the running kernel has no WireGuard support (kernel older than 5.6 without the DKMS module, a kernel upgraded without a reboot, or a container/VPS that shares a host kernel). The userspace implementation wireguard-go is the fallback where no module is possible.

What it looks like

[#] ip link add wg0 type wireguard
RTNETLINK answers: Operation not supported

With recent kernels and iproute2, which pass extended error messages, the same failure is printed as Error: Unknown device type. Both come from ip link add, not from WireGuard's own tools; wg-quick then stops with the exit status of ip (2).

Diagnose

uname -r                               # running kernel (5.6+ has WireGuard built in or as a module)
sudo modprobe wireguard && lsmod | grep wireguard
modinfo wireguard | head -3            # is a module available for this kernel?
ls /lib/modules/$(uname -r)/ >/dev/null || echo "modules for the running kernel are missing: reboot"

modprobe: FATAL: Module wireguard not found in directory /lib/modules/... after a kernel update usually means the new kernel is installed but the old one is still running: reboot.

Fixes

When ip link add fails and the wireguard-go binary is on the PATH, wg-quick prints [!] Missing WireGuard kernel module. Falling back to slow userspace implementation. and continues with the userspace implementation. Its throughput is lower than the kernel module's, but the configuration is the same.