WG(8)

NAME
wg - set and retrieve configuration of WireGuard interfaces

SYNOPSIS
wg [ COMMAND ] [ OPTIONS ]... [ ARGS ]...

DESCRIPTION
wg is the configuration utility for getting and setting the configuration of WireGuard tunnel interfaces. The interfaces themselves can be added and removed using ip-link(8) and their IP addresses and routing tables can be set using ip-address(8) and ip-route(8). The wg utility provides a series of sub-commands for changing WireGuard-specific aspects of WireGuard interfaces. If no COMMAND is specified, COMMAND defaults to show. Sub-commands that take an INTERFACE must be passed a WireGuard interface.

COMMANDS

show { <interface> | all | interfaces } [public-key | private-key | preshared-key | listen-port | peers | endpoints | allowed-ips | latest-handshake | bandwidth]
    Shows current WireGuard configuration of specified <interface>. If no <interface> is specified, <interface> defaults to all. If interfaces is specified, prints a list of all WireGuard interfaces, one per line, and quit. If no options are given after the interface specification, then prints a list of all attributes in a visually pleasing way meant for the terminal. Otherwise, prints specified information grouped by newlines and tabs, meant to be used in scripts.

showconf <interface>
    Shows the current configuration of <interface> in the format described by CONFIGURATION FILE FORMAT below.

set <interface> [listen-port <port>] [private-key <file-path>] [preshared-key <file-path>] [peer <base64-public-key> [remove] [endpoint <ip>:<port>] [allowed-ips <ip1>/<cidr1>[,<ip2>/<cidr2>]...] ]...
    Sets configuration values for the specified <interface>. Multiple peers may be specified, and if the remove argument is given for a peer, that peer is removed, not configured. If listen-port is not specified, the port will be automatically generated when the interface comes up. Both private-key and preshared-key must be a files, because command line arguments are not considered private on most systems but if you are using bash(1), you may safely pass in a string by specifying as private-key or preshared-key the expression: <(echo PRIVATEKEYSTRING). If /dev/null is specified as the filename for either private-key or preshared-key, the key is removed from the device. The use of preshared-key is optional, and may be omitted; it adds an additional layer of symmetric-key cryptography to be mixed into the already existing public-key cryptography, for post-quantum resistance. If allowed-ips is specified, but the value is the empty string, all allowed ips are removed from the peer.

setconf <interface> <configuration-filename>
    Sets the current configuration of <interface> to the contents of <configuration-filename>, which must be in the format described by CONFIGURATION FILE FORMAT below.

addconf <interface> <configuration-filename>
    Appends the contents of <configuration-filename>, which must be in the format described by CONFIGURATION FILE FORMAT below, to the current configuration of <interface>.

genkey
    Generates a random private key in base64 and prints it to standard output.

genpsk
    Generates a random preshared key in base64 and prints it to standard output.

pubkey
    Calculates a public key and prints it in base64 to standard output from a corresponding private key (generated with genkey) given in base64 on standard input. A private key and a corresponding public key may be generated at once by calling:
        $ umask 077
        $ wg genkey | tee private.key | wg pubkey > public.key

help
    Show usage message.

CONFIGURATION FILE FORMAT
The configuration file format is based on INI. There are two top level sections -- Interface and Peer. Multiple Peer sections may be specified, but only one Interface section may be specified.

The Interface section contains two fields:

•   PrivateKey — a base64 private key generated by wg genkey. Required.

•   PresharedKey — a base64 preshared key generated by wg genpsk. Optional, and may be omitted. This option adds an additional layer of symmetric-key cryptography to be mixed into the already existing public-key cryptography, for post-quantum resistance.

•   ListenPort — a 16-bit port for listening. Optional; if not specified, automatically generated based on interface name.

The Peer sections contain three fields each:

•   PublicKey — a base64 public key calculated by wg pubkey from a private key, and usually transmitted out of band to the author of the configuration file. Required.

•   AllowedIPs — a comma-separated list of IP (v4 or v6) addresses with CIDR masks from which this peer is allowed to send incoming traffic and to which outgoing traffic for this peer is directed. The catch-all 0.0.0.0/0 may be specified for matching all IPv4 addresses, and ::/0 may be specified for matching all IPv6 addresses. Required.

•   Endpoint — an endpoint IP or hostname, followed by a colon, and then a port number. Optional.

CONFIGURATION FILE FORMAT EXAMPLE
This example may be used as a model for writing configuration files. Note that not all keys are required.
    [Interface]
    PrivateKey = yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk=
    ListenPort = 41414

    [Peer]
    PublicKey = xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=
    Endpoint = 192.95.5.67:1234
    AllowedIPs = 10.192.122.3/32, 10.192.124.1/24

    [Peer]
    PublicKey = TrMvSoP4jYQlY6RIzBgbssQqY3vxI2Pi+y71lOWWXX0=
    Endpoint = [2607:5300:60:6b0::c05f:543]:2468
    AllowedIPs = 10.192.122.4/32, 192.168.0.0/16

    [Peer]
    PublicKey = gN65BkIKy1eCE9pP1wdc8ROUtkHLF2PfAqYdyYBz6EA=
    Endpoint = test.wireguard.io:18981
    AllowedIPs = 10.10.10.230/32

ENVIRONMENT VARIABLES

WG_COLOR_MODE
    If set to always, always print ANSI colorized output. If set to never, never print ANSI colorized output. If set to auto, something invalid, or unset, then print ANSI colorized output only when writing to a TTY.

SEE ALSO
ip(8), ip-link(8), ip-address(8), ip-route(8).

AUTHOR
wg was written by Jason A. Donenfeld (Jason@zx2c4.com). For updates and more information, a project page is available on the World Wide Web (https://www.wireguard.io/).