Set up the NetOz VPN on Linux with WireGuard

WireGuard is built into the Linux kernel, so connecting a Linux desktop, laptop or server to your organisation's NetOz managed VPN only needs the standard userspace tools. This guide covers the command-line method with wg-quick, which works on almost every distribution, and the NetworkManager method for desktops.

Before you start

• Find the setup email NetOz sent you on behalf of your organisation. Its subject starts with the name of your VPN, followed by "set up" and the device name.
• Check that the link is for this machine. Each device has its own key and link. Using one configuration on two machines makes them fight over the connection.
• You need sudo access.

Step 1 Install wireguard-tools

Install the WireGuard tools from your distribution's package manager.

Debian and Ubuntu:

sudo apt update
sudo apt install wireguard-tools

Fedora:

sudo dnf install wireguard-tools

Arch Linux:

sudo pacman -S wireguard-tools

For other distributions, see wireguard.com/install.

NetOz configurations do not include a DNS = line, so you do not need resolvconf or openresolv for them to work.

Step 2 Download your configuration file

Open the setup link in a browser. In the On a computer section, select the Download button to save the .conf file. The file is named after your VPN and device.

On a headless server, open the link on another computer, download the file there and copy it across securely, for example with scp. The file contains your private key, so do not leave copies lying around.

The setup page also lists the networks the VPN carries under What you'll be able to reach. These are the same ranges as the AllowedIPs line in the file.

Step 3 Install the configuration

wg-quick uses the file name as the network interface name. Linux interface names are limited to 15 characters, so rename the file to something short such as netoz.conf while moving it into place:

sudo install -m 600 -o root -g root ~/Downloads/your-file.conf /etc/wireguard/netoz.conf

Replace your-file.conf with the name of the file you downloaded. The 600 permissions keep the private key readable only by root.

Step 4 Bring the tunnel up

Start the tunnel:

sudo wg-quick up netoz

Then check its status:

sudo wg show netoz

Look for a latest handshake line with a recent time and transfer figures that increase as you use the VPN. A recent handshake means your machine is talking to the NetOz VPN server.

To disconnect:

sudo wg-quick down netoz

Step 5 Start it automatically (optional)

To bring the tunnel up at boot, enable the systemd unit that ships with wireguard-tools:

sudo systemctl enable --now wg-quick@netoz

Because the NetOz VPN is a split tunnel, leaving it permanently on does not affect the machine's other traffic.

Alternative: import into NetworkManager

On desktops that use NetworkManager, such as Ubuntu Desktop, Fedora Workstation or Linux Mint, you can import the file instead of using wg-quick:

nmcli connection import type wireguard file ~/Downloads/your-file.conf

The connection takes its name from the file, so rename the file to something short first. After importing, the VPN appears in your desktop's network menu where you can switch it on and off. Delete the downloaded file once it has been imported.

Use either NetworkManager or wg-quick for the same configuration, not both.

Check you can reach work systems

With the tunnel up, check the routes WireGuard added:

ip route | grep netoz

You should see one route for each network listed under What you'll be able to reach. Then open the internal system your organisation gave you, or test it with curl, ssh or ping against an address your administrator provided.

How the NetOz configuration works

The file has two sections:

• [Interface] holds your device's private key, its tunnel address (a single /32) and an MTU of 1280. The MTU is set low on purpose so that large uploads do not stall on networks with smaller packet sizes. Leave it as it is.
• [Peer] holds the NetOz VPN server's public key, its Endpoint (host and UDP port), the AllowedIPs routed through the tunnel and PersistentKeepalive = 25, which keeps the connection alive behind NAT.

AllowedIPs never contains 0.0.0.0/0. Only the listed networks go through the VPN, and everything else uses your normal connection and DNS.

When things change

If the setup page says the network has changed, your organisation has updated the VPN's destinations. Download the file again, replace /etc/wireguard/netoz.conf with it, then restart the tunnel:

sudo wg-quick down netoz
sudo wg-quick up netoz

Next steps

• Troubleshooting the NetOz WireGuard VPN
• What is the NetOz managed VPN?