WireGuard Configuration (2024)

Wireguard Configuration

WireGuard is an open source encrypted VPN solution; WireGuard configuration support was added to the REST API and Config Shell at release 23.8. WireGuard facilitates communication between two peer devices; in order to communicate with a peer, both devices must have a virtual WireGuard interface configured over the physical or virtual interface they are connected over.

Note:Users who have pre-existing configuration files for WireGuard will not have their configurations overwritten as the configurator will only modify those files if they are initially missing or are prefixed with a disclaimer that manual edits will be overwritten.

Viewing a WireGuard Configuration

WireGuard installs the wg tool which can be used to control, configure and monitor WireGuard . Refer to the WireGuard online tools index page: index : wireguard-tools

Note:OpenGear does not own or operate the WireGuard tools web page and is not responsible for its content or maintenance. The link is provided only for the reader's convenience.

Configure WireGuard through Config Shell or REST API

WireGuard is configured through Config Shell or REST API. The minimum configuration of WireGuard is shown in the following:

1. Provide a name for the interface (wg0 in the example below).

2. Set enabled.

   See Also

   Running WireGuard on Windows Standard User Accounts | Randy Rowland

3. Set the private_key of your WireGuard interface.

4. Add an address (at least one) for your WireGuard interface (10.0.0.1/24 in this case).

5. Add a peer with the following parameters: endpoint_address, endpoint_port, public_key.

6. Add an allowed_ip for your peer. At least one - this is the WireGuard address(es) (as it can also accept an address range) of the other interface to which you are connected.

For example:

config: wireguard
config(wireguard): add wg0
config(wireguard wg0): private_key AGiZvFHY+r/dD0rHSKU5ZCrHNdLM0W/h29VxobxWgFo=
config(wireguard wg0): enabled true
config(wireguard wg0): addresses
config(wireguard wg0 addresses): add 10.0.0.1/24
config(wireguard wg0 addresses): up
config(wireguard wg0): peers
config(wireguard wg0 peers): add
config(wireguard wg0 peers 0): public_key o+quB4sbUAG2hEGSPpMNTnO0YSaQTP7dD+Q4IVjiCW8=
config(wireguard wg0 peers 0): allowed_ips
config(wireguard wg0 peers 0 allowed_ips): add 10.0.0.2/32
config(wireguard wg0 peers 0 allowed_ips): up
config(wireguard wg0 peers 0): endpoint_address 192.168.1.2
config(wireguard wg0 peers 0): endpoint_port 51820
config(wireguard wg0 peers 0): up
config(wireguard wg0 peers): top

Config Shell WireGuard CONFIGURATION

The following shows a typical WireGuard configuration in Config Shell:

config: show wireguard wg0
Entity wireguard item wg0
description ""
enabled true
mtu 1420
name wg0
port 51820
private_key AGiZvFHY+r/dD0rHSKU5ZCrHNdLM0W/h29VxobxWgFo=
public_key ""
table ""
addresses (array)
0 10.0.0.1/24
peers (array)
0 (object)
endpoint_address 192.168.1.2
endpoint_port 51820
keep_alive ""
public_key o+quB4sbUAG2hEGSPpMNTnO0YSaQTP7dD+Q4IVjiCW8=
allowed_ips (array)
0 10.0.0.2/32
post_down_hooks (array)
post_up_hooks (array)
pre_down_hooks (array)
pre_up_hooks (array)

REST API WireGuard CONFIGURATION

The following shows a typical WireGuard configuration in Config Shell:

{
"wireguards": [
{
"enabled": true,
"post_down_hooks": [],
"id": "wireguard_tunnels-1",
"pre_up_hooks": [],
"post_up_hooks": [],
"private_key": "AGiZvFHY+r/dD0rHSKU5ZCrHNdLM0W/h29VxobxWgFo=",
"name": "wg0",
"pre_down_hooks": [],
"addresses": [
"10.0.0.1/24"
],
"peers": [
{
"allowed_ips": [
"10.0.0.2/32"
],
"public_key": "o+quB4sbUAG2hEGSPpMNTnO0YSaQTP7dD+Q4IVjiCW8=",
"endpoint_address": "192.168.1.2",
"endpoint_port": 51820
}
]
}
]
}

Configurable WireGuard FieLds

The WireGuard <interface-name> context holds the configuration for a WireGuard connection. The following fields can be configured:

WireGuard Context Sub-objects

There are a number of sub-objects under the WireGuard context: addresses, peers and hooks.

Addresses

The wireguard <interface-name> addresses context is a list that holds the IPv4 CIDR addresses of the local Wireguard interface. These are statically assigned when the WireGuard interface is brought up.

config: wireguard
config(wireguard): add wg0
config(wireguard wg0): addresses
config(wireguard wg0 addresses): add 10.0.0.1/24

Peers

The following list defines the WireGuard settings for Wireguard-capable remote peers. Each peer has the following fields:

config(wireguard wg0 peers 0): show
Entity wireguard item wg0 field peers 0
endpoint_address ""
endpoint_port ""
keep_alive ""
public_key "" (required)
allowed_ips (array) (required)

Hooks

WireGuard allows for commands to be executed before/after the interface is brought up/down. These can be specified in the following array fields:

Note:Each field is an array of strings that correspond to commands to be executed.

Adding a WireGuard Interface to a Firewall Zone

The WireGuard interface can be added to a firewall zone as in the following example:

Entity firewall/zone item zone
description "" (required)
label "" (required)
masquerade "" (required)
name zone
permit_all_traffic "" (required)
address_filters (array)
custom_rules (array)
physifs (array)
port_forwarding_rules (array)
wireguards (array)