Skip to content
Browse

/errors/wireguard/wg-quick-wg0-already-exists

wg-quick: `wg0' already exists

The commands on this page have not been executed by our verification runner yet.updated
tool
WireGuard
exit code
1
versions
wireguard-tools 1.0
os
linux

wg-quick: `wg0' already exists means wg-quick up wg0 found a network interface named wg0 already present and refused to create it again. The tunnel is usually already running (often started by the wg-quick@wg0 systemd service), or an earlier failed attempt left the interface behind. Bring it down first (wg-quick down wg0, or restart the systemd unit), then up again.

Where the message comes from

wg-quick is a bash script. In src/wg-quick/linux.bash, cmd_up() checks ip link show dev "$INTERFACE" and stops with die "`$INTERFACE' already exists" if the link exists. die prints the program name and message to standard error and exits with status 1. Nothing is changed on the system.

Restart the tunnel

bash
wg-quick down wg0 && wg-quick up wg0
systemctl restart wg-quick@wg0          # when the systemd service manages it
systemctl status wg-quick@wg0
ip link show dev wg0

Run them as root. Mixing the two methods causes this error often: the service has the interface up, and a manual wg-quick up then fails. Use one method for each tunnel.

Leftover interface

If wg-quick down wg0 fails too (for example because the configuration file changed or was moved), remove the interface directly and start again:

bash
ip link delete dev wg0
wg-quick up wg0

Deleting the interface also removes its routes. Policy routing rules and DNS settings that wg-quick up added may stay; check ip rule and resolvectl status afterwards.

Change peers without a restart

bash
wg syncconf wg0 <(wg-quick strip wg0)

wg-quick strip prints the configuration without wg-quick's own keys (Address, DNS, PostUp and so on), and wg syncconf applies peer and key changes to the running interface. Changes to Address, DNS, MTU or the hooks still need a down and up.

Sources

Related pages

commands · wireguardsystemctl enable --now wg-quick@wg0: start WireGuard at bootsudo systemctl enable --now wg-quick@wg0 starts a WireGuard tunnel at boot. What the unit runs, reload versus restart, status checks and common start failures.errors · wireguardwg-quick: RTNETLINK answers: Operation not supported (ip link add wg0 type wireguard)ip link add wg0 type wireguard fails when the kernel lacks the WireGuard module. Load it with modprobe, reboot after a kernel update, or use wireguard-go.errors · wireguardwg-quick: resolvconf: command not foundwg-quick runs resolvconf for the DNS = line and fails when it is missing. Install openresolv or a resolvconf command, or drop DNS and use resolvectl in PostUp.errors · wireguardWarning: `/etc/wireguard/wg0.conf' is world accessiblewg-quick warns that the config holding your private key is readable by other users. Run chmod 600 on it and chmod 700 on /etc/wireguard. The tunnel starts.config · wireguardWireGuard AllowedIPs: routing and peer filtering explainedWireGuard AllowedIPs lists the addresses a peer may send from and the routes sent to it. 0.0.0.0/0, ::/0 routes all traffic; a /32 per peer limits it to one IP.