OnlineGet expert advice in online chat
Create an accountLog in
  1. Blog
  2. Manuals

WireGuard Client Configuration: Template and Parameters Explained

2 min readUnixHost team
WireGuard Client Configuration: Template and Parameters Explained

A WireGuard client needs just one small file. Below is a minimal working template, an explanation of every line, and the commands to bring the tunnel up and confirm it works.

Minimal template

[Interface]
PrivateKey = <client private key>
Address = 10.10.10.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = <server public key>
Endpoint = 203.0.113.10:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

Save it as /etc/wireguard/wg0.conf on Linux, or import it into the WireGuard app for Windows, macOS, Android or iOS.

What each parameter means

The [Interface] section describes the client itself:

  • PrivateKey — the client’s private key. It never leaves the device.
  • Address — the client’s address inside the VPN. It must be unique for each client.
  • DNS — the DNS server used while the tunnel is active. Without it, DNS queries may leak through your ISP.

The [Peer] section describes the server:

  • PublicKey — the server’s public key.
  • Endpoint — the server’s public IP address or domain and the UDP port.
  • AllowedIPs — which addresses go into the tunnel. 0.0.0.0/0, ::/0 routes all traffic through the VPN.
  • PersistentKeepalive — sends a keepalive packet every 25 seconds so the connection survives NAT. Almost every client behind a home router or on a mobile network needs it.

Generating keys

Install WireGuard and create the client key pair:

sudo apt install wireguard
umask 077
wg genkey | tee client.key | wg pubkey > client.pub

Put the contents of client.key into PrivateKey and hand client.pub to the server.

Adding the client on the server

Add a section with the client’s public key and address to the server configuration:

[Peer]
PublicKey = <client public key>
AllowedIPs = 10.10.10.2/32

Apply the change without dropping other connections:

sudo bash -c 'wg syncconf wg0 <(wg-quick strip wg0)'

Start and test

sudo wg-quick up wg0
sudo wg show

The wg show output should contain a latest handshake line with a recent time — the client and server have exchanged keys. Check your public address:

curl ifconfig.me

The command should return the server’s IP address. To bring the tunnel up at boot:

sudo systemctl enable wg-quick@wg0

Split tunnelling

If you only need the VPN for an internal network while other traffic goes out directly, list the required subnets in AllowedIPs:

AllowedIPs = 10.10.10.0/24, 192.168.50.0/24

The DNS parameter is usually removed in this case.

If the tunnel does not work

  • No latest handshake — check that the UDP port is open on the server and the keys are not swapped: [Peer] always holds the public key of the other side.
  • Handshake but no internet — packet forwarding is not enabled on the server (net.ipv4.ip_forward = 1) or the NAT rule is missing.
  • Sites do not open by name — check the DNS parameter.
  • The connection drops after a couple of idle minutes — add PersistentKeepalive = 25.

Your own WireGuard server

A client needs a server. You can deploy one on a VPS in a few minutes — WireGuard with a web interface is the quickest route — and protect it with Fail2Ban and SSH key login.

Related articles