WG-QUICK(8) WireGuard WG-QUICK(8) (NAME) wg-quick - WireGuard (SYNOPSIS) wg-quick [ up | down | save | strip ] [ CONFIG_FILE | INTERFACE ] (DESCRIPTION) WireGuard . up down . up WireGuard IP MTU pre/post up . down WireGuard pre/post down . save . strip wg-quick(8) wg(8) . CONFIG_FILE .conf . INTERFACE /etc/wireguard/INTERFACE.conf . wg(8) ip(8) WireGuard . wg(8) ip(8) . (CONFIGURATION) wg(8) . wg(8) . IP (Allowed IPs) . (0.0.0.0/0 ::/0) ip-rule(8) (Default Gateway) . setconf wg(8) Interface : o Address -- IP ( CIDR) . . o DNS -- IP ( ) DNS IP DNS . . resolvconf -a tun.INTERFACE -m 0 -x resolvconf -d tun.INTERFACE . resolvconf(8) PostUp PostDown . o MTU -- MTU (Endpoint) . MTU . o Table -- . : off auto () . o PreUp, PostUp, PreDown, PostDown -- bash(1) DNS . %i INTERFACE . . o SaveConfig -- true . . INTERFACE wg0 wgvpn0 wgmgmtlan0 . [a-zA-Z0-9_=+.-]{1,15} . cincinnati nyc paris . (EXAMPLES) wg(8) . wg(8) . VPN : [Interface] Address = 10.200.100.8/24 DNS = 10.200.100.1 PrivateKey = oK56DE9Ue9zK76rAc8pBl6opph+1v36lm7cXXsQKrQM= [Peer] PublicKey = GtL7fZc/bLnqZldpVofMCD6hDjrK28SsdLxevJ+qtKU= PresharedKey = /UwcSPg38hW/D9Y3tcS1FOV0K1wuURMbS0sesJEP5ak= AllowedIPs = 0.0.0.0/0 Endpoint = demo.wireguard.com:51820 Address . DNS DNS resolvconf(8) . AllowedIPs . WireGuard ( <> ) PostUp PreDown [Interface] : PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT PostUp PreDown iptables(8) 0.0.0.0/0 AllowedIPs fwmark wg-quick . ( DHCP DHCP PF_PACKET Netfilter .) IPv6 ip6tables(8) . pass(1): PreUp = wg set %i private-key <(pass WireGuard/private-keys/%i) : [Interface] Address = 10.192.122.1/24 Address = 10.10.0.1/16 SaveConfig = true PrivateKey = yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk= ListenPort = 51820 [Peer] PublicKey = xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg= AllowedIPs = 10.192.122.3/32, 10.192.124.1/24 [Peer] PublicKey = TrMvSoP4jYQlY6RIzBgbssQqY3vxI2Pi+y71lOWWXX0= AllowedIPs = 10.192.122.4/32, 192.168.0.0/16 [Peer] PublicKey = gN65BkIKy1eCE9pP1wdc8ROUtkHLF2PfAqYdyYBz6EA= AllowedIPs = 10.10.10.230/32 Address SaveConfig true . Table PostUp PreDown (Policy Routing) . SSH ( TCP ) : [Interface] Address = 10.192.122.1/24 PrivateKey = yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk= ListenPort = 51820 Table = 1234 PostUp = ip rule add ipproto tcp dport 22 table 1234 PreDown = ip rule delete ipproto tcp dport 22 table 1234 [Peer] PublicKey = xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg= AllowedIPs = 0.0.0.0/0 : # wg-quick up /path/to/wgnet0.conf /etc/wireguard/ : # wg-quick up wgnet0 /etc/wireguard/wgnet0.conf . strip : # wg syncconf wgnet0 <(wg-quick strip wgnet0) (SEE ALSO) wg(8), ip(8), ip-link(8), ip-address(8), ip-route(8), ip-rule(8), resolvconf(8). (AUTHOR) wg-quick Jason A. Donenfeld . : WireGuard . ZX2C4 2016 January 1 WG-QUICK(8)