contact@linuxtpoint.com
Linuxtpoint
Candid photograph of a Linux server terminal with a soft olive-green glow against a dark slate background, conveying a calm technical atmosphere.

Step-by-step guides for system administrators — covering command-line basics, web server setup, and preparation material for technical interviews.

Browse Tutorials

Set up a WireGuard VPN server on RHEL 9

This RHEL 9 WireGuard deployment gives remote staff an encrypted route into private systems. It suits laptops, phones and lightweight site-to-site links without the overhead of older VPN daemons.

You need sudo access, a current RHEL 9 installation, and a public IPv4 address or a forwarded UDP endpoint. Port forwarding cannot bypass Australian carrier-grade NAT, and the tunnel subnet must not overlap an office LAN.

Give each client a separate key and only the internal routes it needs. Keep private keys off shared storage, restrict SSH access, and back up the configuration securely.

The steps below cover preparation, key generation, forwarding, firewalld, client setup and verification. Test with one peer before expanding access across Australia.

Prepare the RHEL 9 host

Update the host and install WireGuard’s command-line tools from the official repositories. RHEL 9 includes kernel support; older point releases may expose different packages, so use your entitlement rather than packages built for EL8. Reboot if the running kernel changed.

sudo dnf update -y
sudo dnf install -y wireguard-tools
sudo modprobe wireguard
wg --version

Set the time zone before creating keys. Accurate timestamps simplify handshake diagnostics, particularly around daylight-saving changes in Sydney and Melbourne.

sudo timedatectl set-timezone Australia/Sydney
timedatectl status

Use Australia/Melbourne instead where appropriate, keep NTP enabled, and give the server a stable DNS name for peer endpoints.

Configure keys and tunnel addresses

Generate a unique key pair for the server and every client. Generating client keys on their devices is preferable; this example reserves 10.70.0.2 for a laptop.

sudo install -d -m 700 /etc/wireguard
sudo sh -c 'umask 077; wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub'
sudo cat /etc/wireguard/server.pub

Choose non-overlapping settings for each side.

The server needs:

The client needs:

Create the server configuration with the server values and the laptop’s public key. Replace the placeholders; the private key never leaves the server.

sudo install -m 600 /dev/null /etc/wireguard/wg0.conf
sudoedit /etc/wireguard/wg0.conf

[Interface]
Address = 10.70.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY

[Peer]
PublicKey = LAPTOP_PUBLIC_KEY
AllowedIPs = 10.70.0.2/32

Protect the file with mode 600, and verify every placeholder has been replaced before starting the interface. Keep private keys out of shell history.

Enable forwarding and secure the host

Enable IPv4 forwarding and allow UDP 51820 through firewalld. These commands assume the WAN interface and wg0 are in the public zone; check the active zone on your cloud image. For a VPS, repeat the UDP allowance in its cloud security group.

echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-wireguard-forward.conf
sudo sysctl --system
sudo firewall-cmd --permanent --zone=public --add-port=51820/udp
sudo firewall-cmd --permanent --zone=public --add-masquerade
sudo firewall-cmd --reload

Start the tunnel through systemd and confirm its state. If wg0 already belongs to another zone, remove it there before adding it to public.

sudo firewall-cmd --permanent --zone=public --add-interface=wg0
sudo firewall-cmd --reload
sudo systemctl enable --now wg-quick@wg0
sudo wg show
ip -br address show wg0

The masquerade rule gives peers outbound IPv4 access, but it does not publish internal services. Keep each peer’s AllowedIPs narrow and give every user a separate peer entry. If clients need access through another firewall zone, add a narrowly scoped policy rather than weakening every zone.

Add clients and verify the tunnel

Install the WireGuard client, import the settings and replace the key placeholders. On Linux, save the file as /etc/wireguard/wg0.conf; desktop and mobile apps can import a .conf file or QR code.

[Interface]
Address = 10.70.0.2/32
PrivateKey = LAPTOP_PRIVATE_KEY

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = vpn.example.com:51820
AllowedIPs = 10.70.0.0/24
PersistentKeepalive = 25

Give the administrator only the client’s public key. Add a [Peer] block on the server, assign an unused tunnel address, then reload with sudo wg-quick down wg0 && sudo wg-quick up wg0.

Test with ping 10.70.0.1, then an internal service. Check sudo wg show: a recent handshake and rising transfer counters confirm that traffic is passing.

On a shared Windows workstation, keep VPN keys separate from other applications. The guide on BlueStacks drive relocation illustrates disk organisation, but the WireGuard private key still belongs only in the client’s protected configuration.

Operate the service in Australia

Telstra, Optus and Aussie Broadband use carrier-grade NAT on some consumer connections, so confirm public IPv4 or UDP forwarding. An Australian VPS provider may offer suitable hardware, but valid Red Hat subscription entitlements remain your responsibility.

For business hardware imported into Australia, keep invoices, serial numbers and importer records. Australian Customs and Border Protection can explain clearance and landed-cost requirements. Keep system logs in UTC and translate them to Australian Eastern Standard Time or Australian Eastern Daylight Time for local reports.

Avoid traffic logging unless a documented need justifies it, and do not use the tunnel to bypass Australian filtering requirements or employer controls. If endpoint policy needs a test destination, a gambling-related page such as free spins can serve as a test case; enforce blocks at DNS or endpoint level.

Review peer handshakes, the journal and firewall rules regularly, remove departed users’ keys and test restoration. The practical takeaway is to prove one peer and a recovery path before expanding access.