WireGuard Server and Client Configuration

WireGuard is a small, fast VPN: each side has a key pair, and each peer is identified by its public key and the addresses it is allowed to use. The configuration is short, but the keys must be made on the machines that use them, never copied from a web page.

Server and peers

The server lists an address inside the tunnel and a UDP port, then one [Peer] per client with that client's public key and the tunnel address it may use. AllowedIPs on the server is what the peer may send from and what is routed to it.

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <server private key>

[Peer]
PublicKey = <alice public key>
AllowedIPs = 10.8.0.2/32

Keys come from your machine

Private keys must never be generated by a website or shared in chat. The setup script runs wg genkey on the server, writes the keys with restrictive permissions and fills them into the files.

wg genkey | tee server.key | wg pubkey > server.pub

Full tunnel or split tunnel

On the client, AllowedIPs decides what goes through the VPN. 0.0.0.0/0, ::/0 sends everything, IPv6 included, so nothing leaks around it. A list of networks sends only those.

Site to site

A peer can be a whole network: list the networks behind it on the server's AllowedIPs for that peer, and make sure both sides route between the tunnel and their LAN.

Forwarding and NAT

To let clients reach the internet through the server, enable IP forwarding and masquerade the tunnel network on the outgoing interface. The PostUp and PostDown lines do this when the tunnel starts and stops.

Open the WireGuard VPN generator

Frequently asked questions

Why is a preshared key worth adding?

It adds a symmetric key on top of the public-key exchange, which protects the recorded traffic if public-key cryptography is ever broken.

What does PersistentKeepalive do?

It sends a small packet every N seconds so a client behind NAT stays reachable. 25 is the usual value.

Why can I not reach the server after starting the tunnel?

Check that the UDP port is open in the firewall, that the endpoint is correct on the clients, and that IP forwarding is on if clients should reach other networks.

Guides

• Nginx Reverse Proxy Configuration
• Caddy Reverse Proxy Configuration
• Nginx Static Site Configuration
• Caddy Static Site Configuration
• Nginx + PHP-FPM Configuration
• Caddy + PHP-FPM Configuration
• Nginx SSL/TLS Configuration
• Nginx Load Balancer Configuration
• Caddy Load Balancer Configuration
• Nginx Rate Limiting Configuration
• Nginx Security Headers Configuration
• Caddy Security Headers Configuration
• Nginx Gzip Compression Configuration
• Nginx Caching Configuration
• Caddy HTTPS Redirect Configuration
• Nginx WebSocket Proxy Configuration
• Nginx Content-Security-Policy Header
• Block Bad Bots and Scanners in Nginx
• fail2ban for Nginx
• nginx.conf Best Practices
• Nginx Location Regex Tester
• Deploy Nginx Config with GitHub Actions
• Nginx CORS Headers Configuration
• Nginx Cache-Control Headers Configuration
• Nginx 301 Redirect Map Configuration
• robots.txt, Sitemap and security.txt
• Apache .htaccess Configuration
• Docker Compose and Dockerfile Configuration
• systemd Service and Timer Configuration
• Cron Expression Explainer
• SSH Hardening with sshd_config
• Linux Firewall Rules: ufw, nftables and iptables
• Glob Pattern Tester
• Analysing Nginx Access Logs with awk
• Subnet Mask and CIDR Calculator
• VLAN Configuration on Linux
• Static Routes and Policy Routing on Linux
• NAT and Port Forwarding with nftables
• DHCP Server Configuration
• BIND Zone File Example
• WireGuard Server and Client Configuration