WireGuard - Revision history

TheToddLuci0: Fix broken link format in the wg-quick section

2026-03-27T16:30:56Z

Fix broken link format in the wg-quick section

← Older revision		Revision as of 16:30, 27 March 2026
Line 561:		Line 561:
	== Reuse existing wg-quick config file ==		== Reuse existing wg-quick config file ==

	If you have WireGuard configuration files that you want to use as-is		If you have WireGuard configuration files that you want to use as-is (similarly how you would configure WireGuard e.g. in [https://wiki.debian.org/WireGuard#Step_2_-_Configuration Debian]), without converting them to a declarative NixOS configuration, you can also configure <code>wg-quick</code> to use them. For example, if you have a configuration file <code>/etc/nixos/wireguard/wg0.conf</code>, add the following line to your <code>configuration.nix</code>:
	(similarly how you would
	[https://wiki.debian.org/WireGuard#Step_2_-_Configuration ~~configure~~
	~~WireGuard e.g. in~~ Debian], without converting them to a declarative
	NixOS configuration, you can also configure <code>wg-quick</code> to
	use them. For example, if you have a configuration file
	<code>/etc/nixos/wireguard/wg0.conf</code>, add the following line to
	your <code>configuration.nix</code>:

	<syntaxHighlight lang="nix">		<syntaxHighlight lang="nix">

2026-02-13T14:21:56Z

← Older revision		Revision as of 14:21, 13 February 2026
Line 18:		Line 18:
	systemd.network is recommended due to its powerful configuration interface.		systemd.network is recommended due to its powerful configuration interface.
	wg-quick is suitable for common usage patterns. networking.wireguard seems to		wg-quick is suitable for common usage patterns. networking.wireguard seems to
	have issues with routing. NetworkManager does not ~~supoort~~ Proxy server setup, and		have issues with routing. NetworkManager does not support Proxy server setup, and
	is cubersome to use.		is cubersome to use.

2025-11-20T14:12:12Z

Peer setup: add comment to indicate permissions needed for networkd secret

← Older revision		Revision as of 14:12, 20 November 2025
Line 167:		Line 167:
	ListenPort = 51820;		ListenPort = 51820;

			# ensure file is readable by `systemd-network` user
	PrivateKeyFile = config.age.secrets.wg-key-vps.path;		PrivateKeyFile = config.age.secrets.wg-key-vps.path;

2025-09-27T22:05:04Z

Route for specific user: add port forwading

@@ Line 387: / Line 387: @@
        Family = "both";
+     }
+   ];
 </syntaxhighlight>

2025-09-27T22:02:49Z

Route all traffic over wg0, except endpoint: add ...continued

← Older revision		Revision as of 22:02, 27 September 2025
Line 294:		Line 294:
	FirewallMark = 42;		FirewallMark = 42;

	# we specify that the routing table 1000 must be used		# (... continued) we specify that the routing table 1000 must be used
	# (which is the wireguard routing table). This rule routes all traffic through wireguard.		# (which is the wireguard routing table). This rule routes all traffic through wireguard.
	# inside routingPolicyRules section is called Table, not RouteTable		# inside routingPolicyRules section is called Table, not RouteTable

2025-09-21T21:07:38Z

add solutions for secure dns

← Older revision		Revision as of 21:07, 21 September 2025
Line 32:		Line 32:
	Internet via another peer.		Internet via another peer.

	== DNS for the proxy client ==		== Secure DNS for the proxy client ==

	You can use a secure DNS client such as knot dns resolver,		You can use a secure DNS client such as knot dns resolver,
Line 52:		Line 52:
	}		}
	</syntaxhighlight>		</syntaxhighlight>

			Secure DNS hinders usage of captive portals. See [[systemd-resolved]] for solutions.

	= AllowedIPs =		= AllowedIPs =

2025-09-20T23:20:46Z

Additional routing setups: add mirror on internet archive

← Older revision		Revision as of 23:20, 20 September 2025
Line 785:		Line 785:
	* Site to Site Configuration,		* Site to Site Configuration,

	see [https://docs.procustodibus.com/guide/wireguard/ Pro Custodibus Documentation].		see [https://docs.procustodibus.com/guide/wireguard/ Pro Custodibus Documentation], [https://web.archive.org/web/20250920231827/https://docs.procustodibus.com/guide/wireguard/ Mirror on Internet Archive].

	[[Category:Networking]]		[[Category:Networking]]
	[[Category:VPN]]		[[Category:VPN]]

2025-09-20T23:16:05Z

documentation on more routing and topology setups

← Older revision		Revision as of 23:16, 20 September 2025
Line 775:		Line 775:
	* [https://www.youtube.com/watch?v=us7V2NvsQRA Talk by @fpletz at NixCon 2018 about networkd and his WireGuard setup]		* [https://www.youtube.com/watch?v=us7V2NvsQRA Talk by @fpletz at NixCon 2018 about networkd and his WireGuard setup]
	* [https://web.archive.org/web/20210101230654/https://www.the-digital-life.com/wiki/wireguard-troubleshooting/ WireGuard Troubleshooting (on Web Archive)] shows how to enable debug logs		* [https://web.archive.org/web/20210101230654/https://www.the-digital-life.com/wiki/wireguard-troubleshooting/ WireGuard Troubleshooting (on Web Archive)] shows how to enable debug logs

			= Additional routing setups =

			For documentation on more routing and topology setups, such as

			* Point to Point Configuration,
			* Hub and Spoke Configuration,
			* Point to Site Configuration,
			* Site to Site Configuration,

			see [https://docs.procustodibus.com/guide/wireguard/ Pro Custodibus Documentation].

	[[Category:Networking]]		[[Category:Networking]]
	[[Category:VPN]]		[[Category:VPN]]

2025-09-20T06:31:41Z

DNS for the proxy client: secure dns client

← Older revision		Revision as of 06:31, 20 September 2025
Line 34:		Line 34:
	== DNS for the proxy client ==		== DNS for the proxy client ==

	You can use ~~an external, encrypted~~ DNS such as knot dns resolver,		You can use a secure DNS client such as knot dns resolver,
	which comes with a set of authenticated dns servers		which comes with a set of authenticated dns servers ips
	built in.		built in.

2025-09-20T06:28:04Z

systemd.network: v4 and v6 notice

← Older revision		Revision as of 06:28, 20 September 2025
Line 124:		Line 124:

	Credit: this section is adapted from ArchWiki.		Credit: this section is adapted from ArchWiki.
			This section should fully support IPv4 and v6 dual stack.

	== Peer setup ==		== Peer setup ==