wg-quick: resolvconf: command not found. The DNS Line Needs a Program You Do Not Have

Affiliate disclosure - This post contains Contabo affiliate links. If you grab a VPS through them, we earn a commission at no extra cost to you.

The config is correct, the keys match, and wg-quick up wg0 stops on:

resolvconf: command not found

The message names the real problem exactly, and almost nobody reads it that way. It is not saying your DNS setting is wrong. It is saying a program called resolvconf was supposed to apply it and does not exist on this machine.

What wg-quick actually does with a DNS line

wg-quick is a shell script wrapping the wg command. When your config contains:

[Interface]
DNS = 10.10.0.1

it does not write /etc/resolv.conf itself. It runs the external resolvconf binary and lets that program arbitrate, because several things on a Linux system may want to control the resolver at once and overwriting the file directly is how they fight.

On a desktop distribution that program is present. On a minimal server image, a cloud instance or a container, it usually is not, and the script fails at exactly that line.

Fix 1: install a resolvconf implementation

The direct answer, when nothing else manages your resolver:

apt install openresolv        # Debian, Ubuntu
pacman -S openresolv          # Arch

Then wg-quick up wg0 works unchanged.

⛔ Do not do this if systemd-resolved is running. You would then have two programs claiming authority over one file, and the symptom is worse than the error you started with: DNS that works until something restarts and then does not. Check first:

systemctl is-active systemd-resolved

Fix 2: use systemd-resolved, which you may already have

If that command answers active, the machine already has a resolver manager and wg-quick can talk to it through a compatibility shim. On Debian and Ubuntu:

apt install systemd-resolvconf

This provides a resolvconf command that forwards to systemd-resolved rather than a second independent implementation. Confirm afterwards that the file is managed the way you expect:

ls -l /etc/resolv.conf

A symlink into /run/systemd/resolve/ means systemd-resolved owns it. A plain file means something else does, and that is worth resolving before adding a tunnel to the mix.

Fix 3: set DNS yourself with PostUp

If you would rather not install anything, replace the DNS line with commands that do the job directly:

[Interface]
PostUp = printf 'nameserver 10.10.0.1\n' > /etc/resolv.conf
PostDown = printf 'nameserver 1.1.1.1\n' > /etc/resolv.conf

This is blunt and it works, and its two limits should be stated. It overwrites whatever was in the file, so anything else that manages the resolver will disagree with you. And the PostDown line has to restore something sensible, because a tunnel that goes down leaving an empty resolv.conf takes DNS with it.

For a container or a single purpose VPS where nothing else touches the resolver, this is a perfectly reasonable choice.

Fix 4: decide you do not need it

Delete the DNS line and the tunnel comes up immediately.

That is the correct answer in exactly one case: when the tunnel exists to reach a network, not to hide your lookups. A site to site link between two servers has no reason to change either machine's resolver.

⛔ It is the wrong answer when the tunnel is for privacy. Without tunnel DNS, every name you look up still goes to your previous resolver in the clear, and the traffic being encrypted afterwards does not undo that. The mechanics of that leak are in DNS leak prevention.

Choosing between them

systemd-resolved deja actif -> systemd-resolvconf (fix 2) rien ne gere le resolveur -> openresolv (fix 1) conteneur, VPS mono-usage -> PostUp (fix 3) tunnel entre deux serveurs -> retirer la ligne DNS (fix 4)

If you only want your internal domains resolved through the tunnel and the rest left alone, that is a different setup again: WireGuard split DNS.

And if the tunnel now comes up but nothing loads, DNS was not the problem: see MTU for pages that hang, and handshake troubleshooting if wg show reports no handshake at all.