How to Configure WireGuard Site-to-Site VPN Tunnels with systemd-networkd on Ubuntu

Connecting distributed branch offices, cloud VPCs, and on-premises server racks often relies on legacy IPSec or OpenVPN tunnels. These traditional protocols suffer from complex cryptographic negotiation handshakes, sluggish connection re-establishment, and excessive CPU overhead. WireGuard operates directly within the Linux kernel, using modern state-of-the-art cryptography (Curve25519, ChaCha20-Poly1305, BLAKE2s) to establish ultra-low-latency encrypted links. By managing WireGuard interfaces via native systemd-networkd on Ubuntu Server, network engineers eliminate external scripting dependencies and achieve persistent site-to-site routing.

Site-to-Site Network Topology Architecture

Consider an enterprise connecting Site A (Headquarters) to Site B (Branch Office) over an encrypted virtual overlay:

Topology Node	Physical Endpoint IP	WireGuard Overlay IP	Internal Subnet (Routed LAN)
Site A Gateway (HQ)	198.51.100.10:51820 (Public Static IP)	10.50.0.1/30	192.168.10.0/24
Site B Gateway (Branch)	203.0.113.20:51820 (Public or Dynamic IP)	10.50.0.2/30	192.168.20.0/24

Installing WireGuard and Generating Cryptographic Keypairs

WireGuard is baked into the upstream Linux kernel on Ubuntu 22.04 LTS and 24.04 LTS. Install user-space cryptographic tools:

# Update package repositories and install wireguard tools
sudo apt update && sudo apt install -y wireguard wireguard-tools

# Generate private and public keys on Site A Gateway
umask 077
wg genkey | tee site_a_private.key | wg pubkey > site_a_public.key

# View public key to exchange with Site B
cat site_a_public.key

Repeat the keypair generation process on Site B Gateway to produce site_b_private.key and site_b_public.key.

Enabling IP Forwarding and Kernel Routing on Ubuntu

For Ubuntu to route packets between the physical local network interface and the WireGuard overlay tunnel, enable IPv4 packet forwarding:

# Create persistent sysctl routing configuration
sudo tee /etc/sysctl.d/99-wireguard-forwarding.conf << 'EOF'
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
EOF

# Apply sysctl parameters immediately
sudo sysctl --system

Configuring WireGuard via systemd-networkd on Site A Gateway

Configure the virtual network device (.netdev) and routing link (.network) in /etc/systemd/network/:

# 1. Define the virtual interface: /etc/systemd/network/10-wg0.netdev
[NetDev]
Name=wg0
Kind=wireguard
Description=WireGuard Site-to-Site Tunnel to Branch B

[WireGuard]
ListenPort=51820
PrivateKey=SITE_A_PRIVATE_KEY_HERE

[WireGuardPeer]
PublicKey=SITE_B_PUBLIC_KEY_HERE
Endpoint=203.0.113.20:51820
AllowedIPs=10.50.0.2/32, 192.168.20.0/24
PersistentKeepalive=25

Define the IP addressing and routing table entries for the tunnel:

# 2. Define the network binding: /etc/systemd/network/10-wg0.network
[Match]
Name=wg0

[Network]
Address=10.50.0.1/30

# Route all traffic destined for Branch LAN (192.168.20.0/24) through wg0
[Route]
Destination=192.168.20.0/24
Scope=link

Configuring Site B Gateway (Branch Office)

Apply complementary definitions on Site B Gateway:

# Site B: /etc/systemd/network/10-wg0.netdev
[NetDev]
Name=wg0
Kind=wireguard
Description=WireGuard Tunnel to HQ Site A

[WireGuard]
ListenPort=51820
PrivateKey=SITE_B_PRIVATE_KEY_HERE

[WireGuardPeer]
PublicKey=SITE_A_PUBLIC_KEY_HERE
Endpoint=198.51.100.10:51820
AllowedIPs=10.50.0.1/32, 192.168.10.0/24
PersistentKeepalive=25

# Site B: /etc/systemd/network/10-wg0.network
[Match]
Name=wg0

[Network]
Address=10.50.0.2/30

[Route]
Destination=192.168.10.0/24
Scope=link

Enabling and Validating the Site-to-Site Tunnel

Start systemd-networkd to initialize the interfaces and audit the cryptographic handshake:

# Restart systemd-networkd
sudo systemctl restart systemd-networkd

# Inspect wireguard status and verify latest handshake
sudo wg show

# Test connectivity across the tunnel overlay
ping -c 4 10.50.0.2

# Test end-to-end LAN routing across offices
ping -c 4 192.168.20.1

A non-zero transfer count and recent handshake timestamp (under 2 minutes) verify that high-speed encrypted packets are flowing between branch networks.