Derek Coleman & Associates Inc logoDerek Coleman & Associates Inc

Home / Support / WireGuard on Ubuntu 24.04 LTS

WireGuard on Ubuntu 24.04 LTS — Support & Quick Start

WireGuard on Ubuntu 24.04 LTS — WireGuard is a fast, modern VPN protocol with state-of-the-art cryptography and a minimal attack surface. Published by Derek Coleman & Associates Inc on the Azure Marketplace, deployed in your own Azure subscription.

Email support Product page Azure Marketplace listing

At a glance

Application ports51820/udp (VPN)
Admin credential filesudo cat /etc/wireguard/clients/client1.conf # ready-to-use config for the first peer, client1
Sign in asno login — WireGuard authenticates peers by key pair; the first peer (client1) is generated for you
Service(s)wg-quick@wg0
Configuration/etc/wireguard/wg0.conf (server config, root-only: interface 10.8.0.1/24, listen port 51820, NAT rule, one [Peer] per device); client configs in /etc/wireguard/clients/<name>.conf (0600, root-only); helper /usr/local/sbin/wg-addpeer
Logssudo wg show; journalctl -u wg-quick@wg0
VersionWireGuard (Ubuntu 24.04 package 1.0.20210914)
PlatformUbuntu 24.04 LTS

Quick start

  1. Deploy from the Azure Marketplace (Get It Now → Create), choosing your SSH key at the Administration step.
  2. Allow inbound SSH (22) for yourself plus the application port(s): 51820/udp (VPN) — restrict to your own IP where possible. The in-image firewall already allows them; only the Network Security Group (NSG) keeps them closed.
  3. SSH in and copy the first peer's config to your device: `sudo cat /etc/wireguard/clients/client1.conf` (or `sudo wg-addpeer --qr client1` for a phone) — see First login below.
  4. Connect from the device, then check the handshake on the server with `sudo wg show`. Add more devices with `sudo wg-addpeer <name>`. IP forwarding (/etc/sysctl.d/99-wireguard.conf) and the NAT rule for peer traffic are already in place.

First login / credentials

This image generates its admin credential on the VM at first boot — nothing is pre-set. SSH into the VM with the username + key you chose at deploy, then print the generated credential:

ssh <your-username>@<VM-IP>
sudo cat /etc/wireguard/clients/client1.conf  # ready-to-use config for the first peer, client1

Sign in as no login — WireGuard authenticates peers by key pair; the first peer (client1) is generated for you.

  1. No password exists. First boot generated the server key pair (interface wg0, 10.8.0.1/24) AND your first peer, client1 (10.8.0.2, with its own key pair and preshared key).
  2. Print client1's finished config with `sudo cat /etc/wireguard/clients/client1.conf` and paste it into any WireGuard client, or show it as a QR code for a phone with `sudo wg-addpeer --qr client1`. Its Endpoint is the VM's public IP on 51820 and AllowedIPs is 0.0.0.0/0, so all of the device's IPv4 traffic goes through the VM.
  3. Add another device with `sudo wg-addpeer laptop` (any name of letters, digits, - or _): it takes the next free 10.8.0.x address, adds the peer to the running interface and wg0.conf, and prints the new config (`--qr` for a QR code). The configs hold private keys — copy each to its device and keep them root-only.

There is no password. Each device signs in with its own key pair: client1's config is in /etc/wireguard/clients/client1.conf, and `sudo wg-addpeer <name>` creates the next one.

Troubleshooting

SymptomCheckFix
No /etc/wireguard/clients/ directory, or `wg-addpeer: command not found`The image version your VM was deployed fromThe first peer and the helper ship from image 2026.917.1832 onward. On a VM from an earlier image, add a peer by hand: `wg genkey | tee peer.key | wg pubkey > peer.pub`, append a `[Peer]` block with `PublicKey = <contents of peer.pub>` and `AllowedIPs = 10.8.0.2/32` to /etc/wireguard/wg0.conf, `sudo systemctl restart wg-quick@wg0`, then write the client config with that private key, Address = 10.8.0.2/32, the server's public key (`sudo wg show wg0 public-key`) and Endpoint = <VM public IP>:51820.
The device never completes a handshakeThe Endpoint line in the client config; `sudo wg show` on the serverOn VMs deployed from image 2026.917.1832, client1.conf and wg-addpeer wrote the VM's PRIVATE address as the Endpoint, which no device outside the virtual network can reach — change Endpoint to the public IP. From 2026.1004.2202 the public IP is written. Also check that 51820/udp is allowed in the NSG.

Still stuck?

Email support@dcassociatesgroup.com (response within 1 business day) or send a message via the contact form. Include the offer name, VM size, region, and any log output — sudo journalctl -u <service> -n 100 usually tells the story.