wg(8)
Configure and manage WireGuard VPN interfaces and peers.
Synopsis
wg [ COMMAND ] [ OPTIONS ]Description
wg is the configuration utility for WireGuard, a modern, high-performance VPN implementation. It allows you to view and modify WireGuard interface settings, manage peer configurations, and control cryptographic keys.
WireGuard operates as a kernel module that creates virtual network interfaces (typically wg0, wg1, etc.). The wg command reads and writes interface state through these kernel interfaces, storing persistent configuration in /etc/wireguard/.
Common options
| Flag | What it does |
|---|---|
show | Display all WireGuard interfaces and their peer information |
showconf INTERFACE | Print the configuration of an interface in a portable format |
set INTERFACE | Modify interface settings (private-key, listen-port, etc.) |
peer PUBKEY | Add or modify a peer (use with set); specify allowed-ips, endpoint, etc. |
remove | Delete a peer from an interface (use with set peer) |
private-key | Set the interface's private key (pipe from wg genkey) |
listen-port PORT | Set the UDP port the interface listens on |
allowed-ips CIDR[,CIDR...] | Restrict which IP addresses a peer can send (use with peer) |
endpoint HOST:PORT | Set the peer's endpoint address (use with peer) |
persistent-keepalive SECONDS | Enable keepalive packets for NAT traversal (use with peer) |
preshared-key KEY | Add an optional pre-shared key for additional security |
Examples
Display all active WireGuard interfaces with peers, keys, and traffic statistics
wg showShow detailed status of the wg0 interface only
wg show wg0Generate a new private key and set the interface to listen on port 51820
wg set wg0 listen-port 51820 private-key <(wg genkey)Add a peer with its public key, allowed IP, and endpoint address
wg set wg0 peer AAAA... allowed-ips 10.0.0.2/32 endpoint 203.0.113.45:51820Enable keepalive packets every 25 seconds for a peer behind NAT
wg set wg0 peer BBBB... persistent-keepalive 25Remove a peer from the interface
wg set wg0 peer CCCC... removeExport the current running configuration to a file for persistence
wg showconf wg0 > /etc/wireguard/wg0.confGenerate a keypair: private key saved to privkey, public key to pubkey
wg genkey | tee privkey | wg pubkey > pubkey