wg

wg show is the first check on a WireGuard VPN. For each peer, latest handshake says whether the two ends have talked recently (never, or minutes ago: the tunnel is not up); transfer says whether traffic flows each way; allowed ips says which addresses may go through the tunnel, and so which traffic the device routes into it. wg set changes a running tunnel, wg-quick up NAME brings one up from /etc/wireguard/NAME.conf.

wg command usage

wg show [INTERFACE] [allowed-ips|endpoints|latest-handshakes]
wg set INTERFACE peer KEY allowed-ips LIST
wg-quick up|down NAME

Options

show

every tunnel and peer

show wg0 allowed-ips

one line per peer: its public key and the addresses it may use

set wg0 peer KEY allowed-ips 10.8.0.4/32,10.0.6.0/24

replace that peer's allowed addresses

wg-quick up wg0

create and configure wg0 from its config file

wg examples

wg show

Lists each tunnel's peers with their endpoint, allowed addresses, last handshake and traffic.

wg show wg0 allowed-ips

Lists each peer's key with its allowed addresses: a road warrior's /32, a site's whole network.

wg-quick up wg0

Brings the tunnel wg0 up from /etc/wireguard/wg0.conf, with its addresses and routes.

ip route get 10.8.0.1

Checks that traffic for the VPN's far side is routed into the tunnel card.

Pitfalls

• WireGuard is silent: with a wrong key there is no error, just no handshake.
• allowed ips is also the routing decision: an address not listed never enters the tunnel.
• Required key not available when sending: no peer's allowed ips include that destination.

Run it on real machines