Configuration¶

This page shows where WireGuard's configuration lives, how to add a peer, and how to open the WireGuard port so remote peers can connect.

Where configuration lives¶

Path	What it is
`/etc/wireguard/wg0.conf`	The tunnel configuration, written on first boot. `root` only, mode 0600.
`/etc/wireguard/wg0.private`	This instance's private key. `root` only, mode 0600.
`/etc/wireguard/wg0.public`	This instance's public key.
`/usr/local/share/sushi/wireguard/wg0.public`	A readable copy of the public key, for sharing with peers.
`/etc/wireguard/allow-non-localhost`	Create this file to stop first boot from restoring the localhost allowlist.
`/opt/sushi/etc/wireguard/wg0.conf.tmpl`	The template first boot starts from.

/etc/wireguard is mode 0700, so only root can read the files in it.

The default wg0.conf is:

[Interface]
Address = 10.13.13.1/24
ListenPort = 51820
PrivateKey = <generated on first boot>
Table = off
SaveConfig = false

First boot keeps an existing wg0.conf and private key, so your peers are preserved across reboots.

Add a peer¶

Each peer needs its own key pair and a tunnel address. This example adds a laptop at 10.13.13.2.

On the peer, create a key pair and note its public key. With wireguard-tools installed:
```
wg genkey | tee peer.private | wg pubkey > peer.public
```

On this instance, add a [Peer] section to the end of /etc/wireguard/wg0.conf:

sudo nano /etc/wireguard/wg0.conf

[Peer]
PublicKey = <peer-public-key>
AllowedIPs = 10.13.13.2/32

Apply the change. Restarting the tunnel re-reads the whole file:
```
sudo systemctl restart wg-quick@wg0
```
To add or change peers without taking the interface down, sync the peer list instead:
```
sudo bash -c 'wg syncconf wg0 <(wg-quick strip wg0)'
```
wg syncconf updates peers only. After changing Address or Table, restart the service.

On the peer, create a configuration that points at this instance:

[Interface]
PrivateKey = <contents of peer.private>
Address = 10.13.13.2/24

[Peer]
PublicKey = <contents of /usr/local/share/sushi/wireguard/wg0.public>
Endpoint = <instance-address>:51820
AllowedIPs = 10.13.13.0/24

Open the port to the peer, as described in the next section.

Then check for a handshake on the instance:

sudo wg show wg0

Full-tunnel routing

Do not set AllowedIPs = 0.0.0.0/0 unless you intend to send all of a peer's traffic through the tunnel.

Open the port to remote peers¶

WireGuard listens on UDP 51820 on every address, but the nftables table inet sushi-wireguard drops packets that do not come from 127.0.0.1 or ::1. First boot puts that table back on every boot unless the file /etc/wireguard/allow-non-localhost exists. To accept remote peers:

Create the marker file, then delete the table:

sudo touch /etc/wireguard/allow-non-localhost
sudo nft delete table inet sushi-wireguard

In the instance's security group, allow inbound UDP 51820 only from your peers' addresses.

To close the port again, delete the marker file and load the allowlist:

sudo rm /etc/wireguard/allow-non-localhost
sudo nft -f /opt/sushi/etc/wireguard/localhost-udp.nft

Routes to other networks¶

Table = off means wg-quick adds no routes. Peers inside 10.13.13.0/24 are reachable through the interface's own address. If a peer's AllowedIPs include other networks and you want wg-quick to add routes for them, set Table = auto in the [Interface] section and restart wg-quick@wg0.

Use the instance as a gateway for your VPC¶

If other hosts in your VPC must reach peers through this instance, you also need these AWS changes, which the image does not make for you:

Turn off the source/destination check on the instance.
Add a route for the tunnel network, 10.13.13.0/24, to this instance's network interface in the VPC route tables.

Peer endpoints given as hostnames¶

If a peer's Endpoint is a hostname, wg retries the DNS lookup up to 20 times, and wg-quick@wg0 gives up after 60 seconds. This stops a broken DNS name from holding up boot forever.