wg-admin is a command-line tool to administer WireGuard configuration files. It maintains a local database of networks, which each has a number of peers. From this database, the configuration can be rendered for all peers.
Deploying the configuration is outside the scope of this project.
Add a Network
The defining attribute of the configuration is a network. This is a range of IP addresses specified as
$ wg-admin networks add 192.168.10.0/24
Add a Server
server is a peer with a public DNS name that is reachable by all clients via public internet. It's the entry point for clients into the VPN (a.k.a. relay or bounce server).
$ wg-admin servers add --name wg.example.com $ wg-admin servers add --name wg.example.com --ip 192.168.20.128
This command will add a new server with the given DNS name and a default configuration. If no IP address was passed, the next available address in the network will be used. When no port was specified, the de-facto standard port for WireGuard will be used (
Add a Client
client is regular peer that does not relay (bounce) traffic. It will connect to the VPN via a server.
$ wg-admin client add --name Alice $ wg-admin client add --name Alice --ip 192.168.20.11
If no IP address was passed, the next available address in the network will be used.
$ wg-admin peers list +================+========|=================| | Name | Type | IP Addresses | +================+========|=================| | wg.example.com | server | 192.168.20.1 | +----------------+--------|-----------------| | Alice | client | 192.168.20.11 | +----------------+--------|-----------------|
TODO If this command is run without a (pseudo) terminal, it will print the name of each peer on a single line, which allows for a convenient loop over all peers, e.g. for writing configuration files (see below for further details):
$ for peer in $(wg-admin peers list); do wg-admin config "$peer" > "$peer".conf done
Generate the Config Files
This command will show the configuration of the server itself as well as the necessary fragments for a particular peer:
$ wg-admin config wg.example.com [Interface] Address = 192.168.20.1/24 ListenPort = 51820 PrivateKey = private-key-of-the-server= [Peer] # Name = Alice PublicKey = public-key-of-Alice= AllowedIPs = 192.168.20.11/32
The result is printed to
stdout and could be redirected to a file, or piped into a QR encoder:
$ wg-admin config --client=Alice | qrencode -t ANSIUTF8