I am having difficulty configuring a WireGuard VPN client on my laptop running Debian 13/trixie Linux with XFCE desktop and NetworkManager managing network connections, to connect to the WireGuard VPN server I have configured on my router running OpenWrt.
I installed the wireguard package with: sudo apt install wireguard
I installed dbus-x11 package with: sudo apt install dbus-x11
The dbus-x11 package provides dbus-launch. At one point in my trials I was running nm-connection-editor as root (as some posts suggest this is necessary for it to write configuration to /etc/NetworkManager) and got an error indicating dbus-launch was not found. Installing dbus-x11 resolved this.
I tried configuring the VPN client by opening 'Configure VPN...' from the network icon in the XFCE panel (presented by the Status Tray Plugin of the panel). This appears to run nm-connection-editor, which can also be run from the command line.
This opens a window with title 'Network Connections' and two lists of connections: Wi-Fi and WireGuard. I clicked the '+' icon at bottom left and a new window appeared: Choose a Connection Type. I chose WireGuard and clicked Create.
This opens a window with title 'Editing WireGuard Connection 1'. The default connection name is 'WireGuard Connection 1'. I changed this to 'wg0'.
I completed the form on the WireGuard tab, including a peer with details of the WireGuard server on my router. It all seemed simple, except that when adding the peer I was unable to enter the preshared key until I realized that the icon at the right of the field value text box is clickable and brings up a menu of options, the default being: The password is not required. With the default setting, the input textbox is disabled.
But the connection didn't work. When I re-opened it in the connection editor, I found that sometimes the Preshared key input of the peer configuration was blank and sometimes the Private key input of the connection was blank. There were no pop-up errors or indications that the connection didn't work, but the connection wasn't created and the checkbox beside the VPN name in the pop-up from the network icon in the XFCE panel wasn't checked.
Eventually I found that when I tried to bring up the connection, there logs from NetworkManager in syslog, including:
2026-03-02T10:25:50.614594+13:00 tpt590 NetworkManager[849]: <warn> [1772400350.6144] device (wg0): No agents were available for this request.
2026-03-02T10:25:50.614731+13:00 tpt590 NetworkManager[849]: <info> [1772400350.6145] device (wg0): state change: need-auth -> failed (reason 'no-secrets', managed-type: 'full')
When I added or edited the peer, I could enter the Preshared key after selecting 'Store the password only for this user' or 'Store the password for all users'. I could save the peer configuration then immediately reopen it for edit and all settings remained. But if I saved the connection then reopened it then opened the peer for editing, the Preshared key value was gone. And sometimes the Private key value of the connection was gone. It isn't obvious to me when the Private key value is cleared. Often, but not always, when I open the connection in the connection editor, the Private key value is gone - reverted to blank, though my selection for only this user or all users remains.
If I edited the connection and the Private key was present, then edited the peer and added the Preshared key and saved the peer but didn't save the connection (i.e. the connection editor was still open), then I was able to bring up the connection and the error about missing key did not appear. But as soon as I saved the connection, the Preshared key was lost and I was unable to bring up the connection.
The WireGuard site does not provide documentation for the NetworkManager nm-connection-editor. At least, not that I could find.
I don't know what package provides the functionality for editing WireGuard connections: whether it is part of XFCE, NetworkManager, WireGuard or some other. The forms I see are a bit different from what I see in posts about GNOME connection editor, which makes me think it might be desktop specific. It clearly relates to NetworkManager: the configuration editor is launched by running 'nm-connection-editor', but I suspect there is a plugin provided for WireGuard. Thus far, I don't even know where to ask: there are multiple forums for each of these components.
I am able to configure a client using the 'wg-quick' script and a configuration file I wrote by hand. Or by using the ip and wg commands directly. Bringing up the connection this way results in some configuration in /run/NetworkManager/system-connections, but none of the keys are in the generated file.
I don't know if I'm missing some package or using the connection editor incorrectly or if it is actually misbehaving. Maybe the keys are supposed to disappear from the connection editor. I see some suggestions that they are stored by some sort of agent. But I haven't yet found any helpful documentation about this.
