I'm following these instructions for setting up a (kernel-space) Wireguard VPN on OpenBSD. In my particular case, the VPN server is running OpenBSD and is confirmed to be working correctly (as one of my local OpenBSD machines has been set up as a client).

Most of my local machines aren't OpenBSD boxes though - they're running Debian. As such, I'm trying to stitch together both the aforementioned tutorial and this Debian-specific one.

I'm at the stage where I need to define the client's routes. On OpenBSD, these look like:

On the client side two additional routes are needed:

  1. A more specific route to the server (aa.bb.cc.dd) over the local default gateway (ww.xx.yy.zz)
  2. A default route towards the IP address of the tunnel endpoint

Set the rules as follows:

client# route add -priority 2 aa.bb.cc.dd ww.xx.yy.zz
client# route add -priority 7 default

These instructions, in their current form, obviously don't work on Linux.

What are the equivalent commands on Debian?


route is still the command. man route gives me:

route [-v] [-A family |-4|-6] add [-net|-host] target [netmask Nm] [gw Gw] [metric N] [mss M] [window W] [irtt I] [reject] [mod] [dyn] [reinstate] [[dev] If]

So, basically, the difference is that BSD uses the abstraction of priority while Linux uses the metric to determine the priority. With netstat -rne, you can see the current priorities of your interfaces, so you can choose a convenient number.

You will also note the need to put gw in front of the gateway.

As an example, that would be:

client# route add aa.bb.cc.dd gw ww.xx.yy.zz metric 200
client# route add default gw metric 500

If you omit the metric, it will still work; more specific routes have higher priority than more general. So, in this case, the route to a single server (your VPN endpoint) is more specific than the general "default" (everything).

Linux also has tried to replace the route command with the more complicated ip. Many (and me included) though still use route.

  • I understand it's perhaps an extension to the original question, but in the context of the instructions I linked, what would be meant by "A more specific route to the server (aa.bb.cc.dd) over the local default gateway (ww.xx.yy.zz)"? – jmcph4 Sep 15 '20 at 1:24
  • Added an explanation to answer. – Ljm Dullaart Sep 15 '20 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.