VPN Setup

Set up Cloud1VPN on Linux with WireGuard

Install WireGuard, retrieve your Cloud1VPN tunnel configuration, connect, and verify your public IP.

WireGuard setup for Linux

Choose a VPN protocol

Before you begin

You need an active Cloud1VPN server configured for WireGuard. Open My Servers and retrieve a .conf tunnel file or QR code before importing it into your client.

Get your WireGuard configuration

Linux setup

Connect with WireGuard

Use the official WireGuard client with the tunnel configuration generated for your Cloud1VPN server.

  1. Install WireGuard

    Install WireGuard with your distribution package manager. The official installation page lists commands for major distributions.

    Open the official WireGuard installation page

  2. Download your tunnel configuration

    Open My Servers, choose the WireGuard server, and download its personal .conf file or display its QR code. Treat either format as a private credential.

  3. Import the tunnel

    Save the .conf file securely, import it with NetworkManager, or place it in the WireGuard configuration directory and bring it up with wg-quick.

  4. Connect

    Activate the imported tunnel and approve any Linux request to create or enable the VPN connection.

  5. Verify your connection

    Confirm WireGuard shows a recent handshake, then check that your public IP matches the Cloud1VPN server.

    Open What's My IP?

Frequently Asked Questions

Linux WireGuard setup & troubleshooting

Should I use the .conf file or the QR code?

They contain the same private tunnel configuration. Use the .conf file when Linux supports file import; use the QR code when setting up a mobile device from a separate trusted screen. Never post either format or store it in a shared photo album.

Why will the WireGuard tunnel not import?

Validate the .conf file with the WireGuard tools before starting it. NetworkManager and wg-quick can interpret routes and DNS differently, so use one connection manager for the tunnel rather than importing it into both. If the file was edited, renamed with an extra extension, or downloaded before a server rebuild, retrieve a fresh copy from My Servers.

What does “latest handshake” tell me?

No recent handshake means the client is not completing its encrypted exchange with the server; check the endpoint, server status, key freshness, and whether the current network blocks the connection. A recent handshake proves the peers can communicate, so failures after that point are more likely routing or DNS related.

Why did WireGuard stop working after a rebuild or relocation?

The old tunnel can contain an obsolete endpoint or key pair. Delete the old tunnel, download the new .conf file or QR code, and import it as a new connection instead of changing individual fields by hand.

WireGuard has a handshake, but websites do not load. What should I check?

A current handshake with no browsing usually points to routes, DNS, or another VPN taking priority. Disable competing VPN and proxy software, return custom DNS settings to automatic, reconnect, and then test both a website and What's My IP?.

Why is my normal public IP still visible?

The tunnel may be active without carrying the default internet route. Confirm you imported the complete Cloud1VPN configuration and that another tunnel is not preferred. After reconnecting, What's My IP? should report the address of the Cloud1VPN server for a full-tunnel profile.

Why does the tunnel disconnect after sleep or a network change?

Check the WireGuard or NetworkManager journal at the time of the drop. Suspend/resume, Wi-Fi roaming, and a second route manager can replace the tunnel route.

What should I send support for a WireGuard problem?

Include the Linux version, Cloud1VPN server name, failure time and timezone, whether a latest handshake appears, and the client error text. Never send the .conf file, QR code, private key, or account password.