Manual WireGuard

WireGuard

Location: Connection → WireGuard (status at Status → WireGuard Status)

A newer, generally faster and simpler alternative to OpenVPN. Same overall shape: Wireguard Config chooses Disabled / Client / Server, with a live status readout.

Server mode

Generate or paste a Private Key/Public Key pair (a Generate Keys button handles this for you), then set the tunnel's Internal IP/Internal Subnet, Port, Client-to-Client Traffic (allow peers to see each other, or server-only), LAN Subnet Access (let peers reach your real network, not just the tunnel), and Clients Use Wireguard For (full-tunnel vs. only traffic destined behind the VPN) — all the same concepts as OpenVPN's server mode.

WireGuard also supports an optional Internal IPv6 address and prefix length for dual-stack tunnels, in addition to the IPv4 fields above.

Allowed Clients: add a client name (kept short — the downloaded config file is named after it, and an overly long name won't import cleanly into some WireGuard clients: 15 characters on Linux, 32 on Windows), choose Client Key Management (either Gargoyle generates the client's key pair, or you paste in a public key the client generated itself), the client's internal tunnel IP, how it connects to the server, and — for a site-to-site link — a subnet routed behind that client (with an optional IPv6 subnet pair too).

Client mode

Either Upload Config File (a .conf from your VPN provider) or Configure Manually: server public key, host, and port; your own key pair; your internal tunnel IP; and the same Non-Wireguard Traffic Allow/Block-all choice OpenVPN's client mode has, with the same tradeoff (Block All is safer for a must-never-leak setup, but you lose internet entirely if the tunnel drops).

Status → WireGuard Status

A live table of connected peers — bytes received/sent and last-seen time — or "No clients connected."

See also

• OpenVPN
• DDNS