WG(8) WireGuard WG(8) (NAME) wg - WireGuard (SYNOPSIS) wg [ COMMAND ] [ OPTIONS ]... [ ARGS ]... (DESCRIPTION) wg WireGuard . ip-link(8) IP ip-address(8) ip-route(8) . wg WireGuard . show . INTERFACE WireGuard . (COMMANDS) show { | all | interfaces } [public-key | private-key | listen-port | fwmark | peers | preshared-keys | endpoints | allowed-ips | latest-handshakes | persistent-keepalive | transfer | dump] WireGuard . all . interfaces WireGuard . . . all . dump : private-key public-key listen-port fwmark . (peers) : public- key preshared-key endpoint allowed-ips latest- handshake transfer-rx transfer-tx persistent-keepalive . showconf (CONFIGURATION FILE FORMAT) . set [listen-port ] [fwmark ] [private-key ] [peer [remove] [preshared-key ] [endpoint :] [persistent-keepalive ] [allowed-ips [+|-]/[,[+|-]/]...] ]... . peer remove . listen-port 0 . private-key preshared- key bash(1) : <(echo PRIVATEKEYSTRING) private-key preshared-key . /dev/null private-key preshared-key . preshared-key . allowed-ips IP . allowed-ips IP . IP + - IP '+' IP ( ) IP '-' ( ). persistent-keepalive 0 "off" . ( ) NAT (stateful) . NAT persistent keepalive . fwmark 0 "off" . "0x" . setconf (CONFIGURATION FILE FORMAT) . addconf ( (CONFIGURATION FILE FORMAT) ) . syncconf setconf . setconf . (CONFIGURATION FILE FORMAT) . genkey (base64) . genpsk . pubkey ( genkey) . : $ umask 077 $ wg genkey | tee private.key | wg pubkey > public.key help . (CONFIGURATION FILE FORMAT) INI . : Interface Peer. Peer Interface . Interface : o PrivateKey -- wg genkey . . o ListenPort -- . . o FwMark -- (fwmark) . 0 "off" . "0x" . . Peer : o PublicKey -- wg pubkey (out of band) . . o PresharedKey -- wg genpsk . . . o AllowedIPs -- IP ( ) CIDR . 0.0.0.0/0 IPv4 ::/0 IPv6 . . o Endpoint -- IP . IP . . o PersistentKeepalive -- ( ) NAT . NAT persistent keepalive . 0 "off" . . . . (CONFIGURATION FILE FORMAT EXAMPLE) INI . '#' ( ) (comment) . [Interface] PrivateKey = yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk= ListenPort = 51820 [Peer] PublicKey = xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg= Endpoint = 192.95.5.67:1234 AllowedIPs = 10.192.122.3/32, 10.192.124.1/24 [Peer] PublicKey = TrMvSoP4jYQlY6RIzBgbssQqY3vxI2Pi+y71lOWWXX0= Endpoint = [2607:5300:60:6b0::c05f:543]:2468 AllowedIPs = 10.192.122.4/32, 192.168.0.0/16 [Peer] PublicKey = gN65BkIKy1eCE9pP1wdc8ROUtkHLF2PfAqYdyYBz6EA= Endpoint = test.wireguard.com:18981 AllowedIPs = 10.10.10.230/32 (DEBUGGING INFORMATION) . (dynamic debugging) dmesg(1) : # modprobe wireguard && echo module wireguard +p > /sys/kernel/debug/dynamic_debug/control OpenBSD FreeBSD ifconfig(1) dmesg(1) : # ifconfig wg0 debug (userspace) LOG_LEVEL verbose . (ENVIRONMENT VARIABLES) WG_COLOR_MODE always ANSI . never ANSI . auto ANSI TTY . WG_HIDE_KEYS never show . always "(hidden)" . WG_ENDPOINT_RESOLUTION_RETRIES infinity DNS . . (SEE ALSO) wg-quick(8), ip(8), ip-link(8), ip-address(8), ip-route(8). (AUTHOR) wg Jason A. Donenfeld . : (World Wide Web) . ZX2C4 2015 August 13 WG(8)