The Raspberry Pi Kernel has now been updated beyond Linux 5.6, meaning Wireguard has been included in the Kernel and the below shouldn’t be necessary on a recent version of Raspberry Pi OS.

This guide is mostly for my own reference after an entire day of trying to figure out how to get this working. I’ve just posted it here in case anyone else might find it useful.

I first needed a 64 bit kernel for a docker container, and then a couple of months later when trying to use WireGuard realised it wasn’t going to be easy without kernel headers and a 32-bit userland. After piecing together varying sources of information, the below should work at the time of posting on a Raspberry Pi 3 B+ running the latest Raspbian, and with arm_64bit=1 in /boot/config.txt.

The idea here is -

  • Download a 64 bit base image
  • mount & chroot in
  • Build against the 64 bit kernel
  • Put the module in the correct folder
  • Load the module

Create a folder somewhere, I called it ubuntu
mkdir ubuntu; cd ubuntu

Download the latest ubuntu base image

Unpack it
tar -xzf groovy-base-arm64.tar.gz

Download the kernel source code for your Raspberry Pi, can be checked with uname -a and then compared against the date that has the same kernel number by checking the Makefile in the root of the repository


In my case, 4.19.118 is in the raspberrypi-kernel_1.20200512-2 release. Not sure why since the Raspbian image has 20200527 on it, but double check after downloading by using

unzip -p linux-raspberrypi-kernel_1.20200512-2/Makefile | head -6

If that seems fine, unzip this too


Clone the source for WireGuard

git clone

Sort out the appropriate mounts & configure networking

cat /etc/resolv.conf > etc/resolv.conf
mount -B /dev dev 
mount -B /proc proc 
mount -B /sys sys
mount -t tmpfs tmp tmp

chroot in

sudo chroot .

Run apt update

apt update

Install the necessary packages (not sure if all of these are needed but it worked this way!)

apt-get install libelf-dev build-essential pkg-config locales-all bc bison flex libssl-dev kmod

Configure the kernel

cd linux-raspberrypi-kernel_1.20200512-2
make bcm2711_defconfig 
make prepare 
make scripts

Compile the kernel module

cd ../wireguard-linux-compat/src/
make -C /linux-raspberrypi-kernel_1.20200512-2 M=$PWD modules

Exit the chroot and copy over the files

sudo cp wireguard-linux-compat/src/wireguard.ko /lib/modules/4.19.118-v8+/wireguard.ko

If everything has gone correctly you should be able to

modprobe wireguard

If you feel daring, here it is in one bash script: