wg-quick up wg0

WireGuard Config Generator

WireGuard configs come in pairs and the two halves have to agree. Set the tunnel up once here and get both files, plus the key commands and the forwarding rules.

Must not clash with any LAN you use.
Check with: ip route get 1.1.1.1
Used by split tunnel mode.
Options
Server config (/etc/wireguard/wg0.conf)
Peer config and key generation

AllowedIPs is a routing table, not an ACL

The name misleads almost everyone. On a peer, AllowedIPs says which destinations get sent through the tunnel: 0.0.0.0/0 routes everything, a LAN subnet routes only that. On the server, the same field says which source addresses that peer is permitted to use, and it is how WireGuard decides which peer a packet belongs to. Two peers cannot share an address. If traffic is not flowing, AllowedIPs is where to look first.

Generate matching WireGuard server and client configs

This WireGuard config generator produces both halves of a working tunnel: a server wg0.conf with a peer block per client, and a client config with the right AllowedIPs for a full VPN or a split tunnel. It includes nftables masquerade rules for gateway mode, the ip_forward setting people forget, PersistentKeepalive for peers behind NAT, and the wg genkey commands to create the keypairs.

WireGuard FAQ

Where do the keys in this config come from?

You generate them yourself, and the placeholders mark where each goes. Run umask 077 first so the private keys are not world readable, then wg genkey | tee server.key | wg pubkey > server.pub for each side. Never paste a private key into a peer config; each side holds its own private key and the other side’s public key.

Why can I connect but not reach the internet?

Two usual causes. IP forwarding is off, so the server will not route between interfaces: set net.ipv4.ip_forward=1. Or there is no NAT rule, so replies from the internet have nowhere to return to: the masquerade rule in PostUp handles that. Check both before suspecting the tunnel.

What does PersistentKeepalive actually fix?

A peer behind NAT has no reachable address until it sends something, and the NAT mapping expires after a period of silence. Sending a small packet every 25 seconds keeps the mapping alive so the server can initiate traffic. Set it on the peer behind NAT, not on the publicly reachable server.

Do I need to open the port in my firewall?

Yes, UDP on your listen port, 51820 by default. WireGuard is UDP only. If you use ufw the rule is ufw allow 51820/udp, and the ufw rule builder has it as a preset.

More Linux command tools

Crontab Generator Build cron schedule expressions visually, with plain-English previews of when your job will run. tar Builder Compose tar archive and extract commands with the right compression flags, without memorizing xvzf incantations. systemd Unit Builder Generate systemd service files with restart policies, dependencies, and sandboxing options. chmod / chown Builder Work out permission octals and ownership commands with a visual rwx matrix. rsync Builder Build rsync sync and backup commands with delete safety, excludes, and SSH transport options. SSH Config Builder Generate ~/.ssh/config host blocks with keys, jump hosts, and connection keepalives. find Builder Compose find commands with type, name, time, and size filters, plus prune lists and safe actions. /etc/fstab Builder Build fstab mount lines with the right options, dump, and pass ordering for disks and network shares. OpenSSL CSR Builder Generate certificate signing request commands with subject fields and SAN entries filled in. journalctl Query Builder Compose systemd journal queries with unit, boot, priority, time-range, and grep filters. docker run Builder Build docker run commands with ports, volumes, env vars, and restart policies. Podman-compatible. ufw Rule Builder Build ufw firewall rules with allow/deny/limit actions, source restrictions, and comments. systemd Timer Builder Generate paired .timer and .service units with OnCalendar schedules, persistence, and randomised delay. Reverse Proxy Config Builder Write nginx or Caddy config for a self-hosted service, with TLS, WebSockets, and forwarded headers. Docker Compose Generator Build a docker-compose.yml with volumes, environment, ports, restart policy, and healthcheck. nftables Rule Builder Generate nftables rules and a stateful starter ruleset for the inet filter table. Samba and NFS Share Builder Create an smb.conf share block or an /etc/exports line, with the client mount commands. useradd / usermod Builder Build user creation and modification commands without accidentally wiping group membership. sed Command Builder Compose substitution, deletion, and insertion commands with safe in-place editing and backups. LVM Command Builder Get the full command sequence for creating, extending, and snapshotting logical volumes. restic / Borg Backup Builder Build init, backup, retention, and restore commands for restic or BorgBackup repositories. tcpdump Filter Builder Assemble BPF capture filters by host, port, and protocol, with rotation and Wireshark output. dd Bootable USB Builder Write an ISO to a USB drive, with the device identification and checksum checks to run first. ffmpeg Command Builder Convert, compress, trim, scale, and extract audio with the arguments in the right order. umask Calculator See what a umask produces for new files and directories, and where to set it persistently. GPG Command Builder Verify signed downloads, generate keys, and sign files or git commits without guessing flags. Subnet Calculator Work out network, broadcast, host range, and masks for any IPv4 or IPv6 CIDR block, and split networks into subnets. curl Command Builder Build curl requests with methods, headers, JSON or form bodies, uploads, auth, retries, and timeouts. ssh-keygen Builder Generate Ed25519, RSA, or FIDO2 security key SSH keys, then install them with ssh-copy-id. sudoers Rule Builder Write sudoers.d rules with run-as targets, NOPASSWD, and limited command lists, validated with visudo. logrotate Config Generator Generate /etc/logrotate.d files with rotation schedules, retention, compression, and postrotate reloads. Podman Quadlet Generator Turn a container into a systemd service with a Quadlet .container file, rootless or rootful. Netplan Config Generator Write Netplan YAML for static IPs, DHCP, bridges, and VLANs on Ubuntu, applied safely with netplan try. grep Command Builder Build recursive grep searches with regex modes, context lines, and include or exclude filters, plus the ripgrep equivalent.

View all tools →