WG-QUICK(8)

NAME
wg-quick - set up a WireGuard interface simply

SYNOPSIS
wg-quick [ up | down ] [ CONFIG_FILE | INTERFACE ]

DESCRIPTION
This is an extremely simple script for easily bringing up a WireGuard interface, suitable for a few common use cases. Use up to add and set up an interface, and use down to tear down and remove an interface. Running up adds a WireGuard interface, brings up the interface with the supplied IP addresses, sets up routes, and optionally runs pre/post up scripts. Running down optionally saves the current configuration, removes the WireGuard interface, and optionally runs pre/post down scripts. CONFIG_FILE is a configuration file, whose filename is the interface name followed by `.conf'. Otherwise, INTERFACE is an interface name, with configuration found at `/etc/wireguard/INTERFACE.conf'. Generally speaking, this utility is just a simple script that wraps invocations to wg(8) and ip(8) in order to set up a WireGuard interface. It is designed for users with simple needs, and users with more advanced needs are highly encouraged to use a more specific tool, a more complete network manager, or otherwise just use wg(8) and ip(8), as usual.

CONFIGURATION
The configuration file adds a few extra configuration values to the format understood by wg(8) in order to configure additional attribute of an interface. It handles the values that it understands, and then it passes the remaining ones directly to wg(8) for further processing. It infers all routes from the list of peers' allowed IPs, and automatically adds them to the system routing table. If one of those routes is the default route (0.0.0.0/0 or ::/0), then it uses ip-rule(8) to handle overriding of the default gateway. The configuration file will be passed directly to wg(8)'s `setconf' sub-command, with the exception of the following additions to the Interface section, which are handled by this tool:

•   Address — a comma-separated list of ip (v4 or v6) addresses (optionally with CIDR masks) to be assigned to the interface. May be specified multiple times.

•   PreUp, PostUp, PreDown, PostDown — script snippets which will be executed by bash(1) before/after setting up/tearing down the interface, most commonly used to configure DNS. The special string `%i' is expanded to INTERFACE.

•   SaveConfig — if set to `true', the configuration is saved from the current state of the interface upon shutdown.

Recommended INTERFACE names include `wg0' or `wgvpn0' or even `wgmgmtlan0'. However, the number at the end is in fact optional, and really any free-form string [a-zA-Z0-9_=+.-]{1,16} will work. So even interface names corresponding to geographic locations would suffice, such as `cincinnati', `nyc', or `paris', if that's somehow desirable.

EXAMPLES
These examples draw on the same syntax found for wg(8), and a more complete description may be found there. Bold lines below are for options that extend wg(8). The following might be used for connecting as a client to a VPN gateway for tunneling all traffic:
    [Interface]
    Address = 10.200.100.8/24
    PostUp = echo nameserver 10.200.100.1 | resolvconf -a %i -m 0 -x
    PostDown = resolvconf -d %i
    PrivateKey = oK56DE9Ue9zK76rAc8pBl6opph+1v36lm7cXXsQKrQM=
    PresharedKey = /UwcSPg38hW/D9Y3tcS1FOV0K1wuURMbS0sesJEP5ak=

    [Peer]
    PublicKey = GtL7fZc/bLnqZldpVofMCD6hDjrK28SsdLxevJ+qtKU=
    AllowedIPs = 0.0.0.0/0
    Endpoint = demo.wireguard.io:51820
Notice that the `PostUp` and `PostDown` commands are used here to configure DNS using resolvconf(8), which is one of the many options for DNS configuration. The `Address` field is added here in order to set up the address for the interface. The peer's allowed IPs entry implies that this interface should be configured as the default gateway, which this script does. Here is a more complicated example, fit for usage on a server:

    [Interface]
    Address = 10.192.122.1/24
    Address = 10.10.0.1/16
    SaveConfig = true
    PrivateKey = yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk=
    ListenPort = 51820

    [Peer]
    PublicKey = xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=
    AllowedIPs = 10.192.122.3/32, 10.192.124.1/24

    [Peer]
    PublicKey = TrMvSoP4jYQlY6RIzBgbssQqY3vxI2Pi+y71lOWWXX0=
    AllowedIPs = 10.192.122.4/32, 192.168.0.0/16

    [Peer]
    PublicKey = gN65BkIKy1eCE9pP1wdc8ROUtkHLF2PfAqYdyYBz6EA=
    AllowedIPs = 10.10.10.230/32 Notice the two `Address' lines at the top, and that `SaveConfig' is set to `true', indicating that the configuration file should be saved on shutdown using the current status of the interface. These configuration files may be placed in any directory, putting the desired interface name in the filename: # wg-quick up /path/to/wgnet0.conf For convienence, if only an interface name is supplied, it automatically chooses a path in `/etc/wireguard/': # wg-quick up wgnet0 This will load the configuration file `/etc/wireguard/wgnet0.conf'.

SEE ALSO
wg(8), ip(8), ip-link(8), ip-address(8), ip-route(8), ip-rule(8).

AUTHOR
wg-quick was written by Jason A. Donenfeld (Jason@zx2c4.com). For updates and more information, a project page is available on the World Wide Web (https://www.wireguard.io/).