# wg

## NAME



           wg - set and retrieve configuration of WireGuard interfaces
    


## SYNOPSIS



           **wg**[ _COMMAND_ ] [ _OPTIONS_ ]... [ _ARGS_ ]...
    


## DESCRIPTION



           **wg** is the configuration utility for getting and setting the
           configuration of WireGuard tunnel interfaces. The interfaces
           themselves can be added and removed using ip-link(8) and their IP
           addresses and routing tables can be set using ip-address(8) and
           ip-route(8).  The **wg** utility provides a series of sub-commands for
           changing WireGuard-specific aspects of WireGuard interfaces.
    
           If no COMMAND is specified, COMMAND defaults to **show**.  Sub-
           commands that take an INTERFACE must be passed a WireGuard
           interface.
    


## COMMANDS



           **show**{ _< interface>_ | _all_ | _interfaces_ } [_public-key_ | _private-key_
           | _listen-port_ | _fwmark_ | _peers_ | _preshared-keys_ | _endpoints_ |
           _allowed-ips_ | _latest-handshakes_ | _persistent-keepalive_ | _transfer_
           | _dump_]
                  Shows current WireGuard configuration and runtime
                  information of specified _< interface>_.  If no _< interface>_ is
                  specified, _< interface>_ defaults to _all_.  If _interfaces_ is
                  specified, prints a list of all WireGuard interfaces, one
                  per line, and quits. If no options are given after the
                  interface specification, then prints a list of all
                  attributes in a visually pleasing way meant for the
                  terminal. Otherwise, prints specified information grouped
                  by newlines and tabs, meant to be used in scripts. For this
                  script-friendly display, if _all_ is specified, then the
                  first field for all categories of information is the
                  interface name. If _dump_ is specified, then several lines
                  are printed; the first contains in order separated by tab:
                  private-key, public-key, listen-port, fwmark. Subsequent
                  lines are printed for each peer and contain in order
                  separated by tab: public-key, preshared-key, endpoint,
                  allowed-ips, latest-handshake, transfer-rx, transfer-tx,
                  persistent-keepalive.
    
           **showconf** _< interface>_
                  Shows the current configuration of _< interface>_ in the
                  format described by _CONFIGURATION FILE FORMAT_ below.
    
           **set** _< interface>_ [_listen-port <port>_] [_fwmark <fwmark>_] [_private-_
           _key <file-path>_] [_peer <base64-public-key>_ [_remove_] [_preshared-key_
           _< file-path>_] [_endpoint <ip>:<port>_] [_persistent-keepalive_
           _< interval seconds>_] [_allowed-ips_
           _[+|-] <ip1>/<cidr1>_[,_[+|-] <ip2>/<cidr2>_]...] ]...
                  Sets configuration values for the specified _< interface>_.
                  Multiple _peer_ s may be specified, and if the _remove_ argument
                  is given for a peer, that peer is removed, not configured.
                  If _listen-port_ is not specified, or set to 0, the port will
                  be chosen randomly when the interface comes up. Both
                  _private-key_ and _preshared-key_ must be files, because
                  command line arguments are not considered private on most
                  systems but if you are using bash(1), you may safely pass
                  in a string by specifying as _private-key_ or _preshared-key_
                  the expression: <(echo PRIVATEKEYSTRING). If _/dev/null_ or
                  another empty file is specified as the filename for either
                  _private-key_ or _preshared-key_ , the key is removed from the
                  device. The use of _preshared-key_ is optional, and may be
                  omitted; it adds an additional layer of symmetric-key
                  cryptography to be mixed into the already existing public-
                  key cryptography, for post-quantum resistance.  If _allowed-_
                  _ips_ is specified, but the value is the empty string, all
                  allowed ips are removed from the peer. By default, _allowed-_
                  _ips_ replaces a peer's allowed ips. If + or - is prepended
                  to any of the ips then the update is incremental; ips
                  prefixed with '+' or '' are added to the peer's allowed ips
                  if not present while ips prefixed with '-' are removed if
                  present.  The use of _persistent-keepalive_ is optional and
                  is by default off; setting it to 0 or "off" disables it.
                  Otherwise it represents, in seconds, between 1 and 65535
                  inclusive, how often to send an authenticated empty packet
                  to the peer, for the purpose of keeping a stateful firewall
                  or NAT mapping valid persistently. For example, if the
                  interface very rarely sends traffic, but it might at
                  anytime receive traffic from a peer, and it is behind NAT,
                  the interface might benefit from having a persistent
                  keepalive interval of 25 seconds; however, most users will
                  not need this. The use of _fwmark_ is optional and is by
                  default off; setting it to 0 or "off" disables it.
                  Otherwise it is a 32-bit fwmark for outgoing packets and
                  may be specified in hexadecimal by prepending "0x".
    
           **setconf** _< interface> <configuration-filename>_
                  Sets the current configuration of _< interface>_ to the
                  contents of _< configuration-filename>_, which must be in the
                  format described by _CONFIGURATION FILE FORMAT_ below.
    
           **addconf** _< interface> <configuration-filename>_
                  Appends the contents of _< configuration-filename>_, which
                  must be in the format described by _CONFIGURATION FILE_
                  _FORMAT_ below, to the current configuration of _< interface>_.
    
           **syncconf** _< interface> <configuration-filename>_
                  Like **setconf** , but reads back the existing configuration
                  first and only makes changes that are explicitly different
                  between the configuration file and the interface. This is
                  much less efficient than **setconf** , but has the benefit of
                  not disrupting current peer sessions. The contents of
                  _< configuration-filename>_ must be in the format described by
                  _CONFIGURATION FILE FORMAT_ below.
    
           **genkey** Generates a random _private_ key in base64 and prints it to
                  standard output.
    
           **genpsk** Generates a random _preshared_ key in base64 and prints it to
                  standard output.
    
           **pubkey** Calculates a _public_ key and prints it in base64 to standard
                  output from a corresponding _private_ key (generated with
                  _genkey_) given in base64 on standard input.
    
                  A private key and a corresponding public key may be
                  generated at once by calling:
                      $ umask 077
                      $ wg genkey | tee private.key | wg pubkey > public.key
    
           **help** Shows usage message.
    


## CONFIGURATION FILE FORMAT



           The configuration file format is based on _INI_. There are two top
           level sections -- _Interface_ and _Peer_. Multiple _Peer_ sections may
           be specified, but only one _Interface_ section may be specified.
    
           The _Interface_ section may contain the following fields:
    
           •      PrivateKey — a base64 private key generated by _wg genkey_.
                  Required.
    
           •      ListenPort — a 16-bit port for listening. Optional; if not
                  specified, chosen randomly.
    
           •      FwMark — a 32-bit fwmark for outgoing packets. If set to 0
                  or "off", this option is disabled. May be specified in
                  hexadecimal by prepending "0x". Optional.
    
           The _Peer_ sections may contain the following fields:
    
           •      PublicKey — a base64 public key calculated by _wg pubkey_
                  from a private key, and usually transmitted out of band to
                  the author of the configuration file. Required.
    
           •      PresharedKey — a base64 preshared key generated by _wg_
                  _genpsk_. Optional, and may be omitted. This option adds an
                  additional layer of symmetric-key cryptography to be mixed
                  into the already existing public-key cryptography, for
                  post-quantum resistance.
    
           •      AllowedIPs — a comma-separated list of IP (v4 or v6)
                  addresses with CIDR masks from which incoming traffic for
                  this peer is allowed and to which outgoing traffic for this
                  peer is directed. The catch-all _0.0.0.0/0_ may be specified
                  for matching all IPv4 addresses, and _::/0_ may be specified
                  for matching all IPv6 addresses. May be specified multiple
                  times.
    
           •      Endpoint — an endpoint IP or hostname, followed by a colon,
                  and then a port number. This endpoint will be updated
                  automatically to the most recent source IP address and port
                  of correctly authenticated packets from the peer.
                  Optional.
    
           •      PersistentKeepalive — a seconds interval, between 1 and
                  65535 inclusive, of how often to send an authenticated
                  empty packet to the peer for the purpose of keeping a
                  stateful firewall or NAT mapping valid persistently. For
                  example, if the interface very rarely sends traffic, but it
                  might at anytime receive traffic from a peer, and it is
                  behind NAT, the interface might benefit from having a
                  persistent keepalive interval of 25 seconds. If set to 0 or
                  "off", this option is disabled. By default or when
                  unspecified, this option is off. Most users will not need
                  this. Optional.
    


## CONFIGURATION FILE FORMAT EXAMPLE



           This example may be used as a model for writing configuration
           files, following an INI-like syntax. Characters after and
           including a '#' are considered comments and are thus ignored.
    
               [Interface]
               PrivateKey = yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk=
               ListenPort = 51820
    
               [Peer]
               PublicKey = xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=
               Endpoint = 192.95.5.67:1234
               AllowedIPs = 10.192.122.3/32, 10.192.124.1/24
    
               [Peer]
               PublicKey = TrMvSoP4jYQlY6RIzBgbssQqY3vxI2Pi+y71lOWWXX0=
               Endpoint = [2607:5300:60:6b0::c05f:543]:2468
               AllowedIPs = 10.192.122.4/32, 192.168.0.0/16
    
               [Peer]
               PublicKey = gN65BkIKy1eCE9pP1wdc8ROUtkHLF2PfAqYdyYBz6EA=
               Endpoint = test.wireguard.com:18981
               AllowedIPs = 10.10.10.230/32
    


## DEBUGGING INFORMATION



           Sometimes it is useful to have information on the current runtime
           state of a tunnel. When using the Linux kernel module on a kernel
           that supports dynamic debugging, debugging information can be
           written into dmesg(1) by running as root:
    
               **# modprobe wireguard && echo module wireguard +p >**
           **/sys/kernel/debug/dynamic_debug/control**
    
           On OpenBSD and FreeBSD, debugging information can be written into
           dmesg(1) on a per-interface basis by using **ifconfig**(1):
    
               **# ifconfig wg0 debug**
    
           **On userspace implementations, it is customary to set the** _LOG_LEVEL_
           **environment variable to** _verbose_**.**
    


## ENVIRONMENT VARIABLES



           _WG_COLOR_MODE_
                  If set to _always_ , always print ANSI colorized output. If
                  set to _never_ , never print ANSI colorized output. If set to
                  _auto_ , something invalid, or unset, then print ANSI
                  colorized output only when writing to a TTY.
    
           _WG_HIDE_KEYS_
                  If set to _never_ , then the pretty-printing **show** sub-command
                  will show private and preshared keys in the output. If set
                  to _always_ , something invalid, or unset, then private and
                  preshared keys will be printed as "(hidden)".
    
           _WG_ENDPOINT_RESOLUTION_RETRIES_
                  If set to an integer or to _infinity_ , DNS resolution for
                  each peer's endpoint will be retried that many times for
                  non-permanent errors, with an increasing delay between
                  retries. If unset, the default is 15 retries.
    


* * *