Welcome to the r/WireGuard subreddit!

WireGuard authorizes a connection based on possession of a valid profile. It does not verify who is holding that profile — by design the profile is trusted implicitly. A copied config file authenticates identically to the original because nothing in the protocol is meant to check further than that.

MFA Firewall Knocker is a complement to WireGuard that adds a layer authenticating the person before the network layer is exposed. It uses WebAuthn, served from an unprivileged web app, to validate that the holder of the profile is the intended user before the firewall is opened. The holder authenticates with a passkey — a platform authenticator (Windows Hello, Touch ID, Face ID, Android biometric), with user verification (biometric or PIN) required on the assertion. On success, a service opens a firewall rule for that user's source IP and the configured port/protocol; the tunnel stays reachable for the rest of that window without re-authenticating. The rule expires automatically on a configurable interval, clamped to 1–48 hours — re-authentication happens on that cadence (e.g. every 8-12 hours), not per connection.

It does not modify WireGuard, does not touch its keys or config, and sits entirely in front of WireGuard. The gate and WireGuard operate independently, so a flaw in one is not a flaw in the other.

Implementation: C#, .NET 10, MIT licensed. Runs on Windows Server or Linux. No control plane, no external service, no agent — the firewall rule is created directly via NetSecurity on Windows or iptables on Linux.

Stated limitations:

- Gating is per-IP, so the authenticating address and the connecting address must match. This degrades behind CGNAT and most corporate VPNs, where several users can share one address or the address can change between requests.

- The project only ever opens a port on authentication and removes that rule after a time limit. It never adds a rule to close a port.

- The gate keys on the IP that authenticated, not on the WireGuard peer, so it does not participate in WireGuard's normal endpoint roaming. If that IP changes mid-session, re-authentication is required before the tunnel can reconnect.

- As with any such system, don't rely on a single way to connect to a network — an expired TLS certificate on the gate blocks all authentication, since WebAuthn requires a secure context.

WireGuard was the original motivating case; SSH and RDP or any port can be gated the same way. Written and used for our own infrastructure.

Hi all. Fairly new to WG - is it normal to lose pretty much half the available bandwidth when running via WG over pfsense? The pfsense vm has 2 dedicated vcpus on an i7 8700k and 4gb ddr4. Even testing on direct WiFi on iperf3 my throughput halves the available bandwidth.

Hey everyone,

I've been heads-down building Knoten. An open-source, peer-to-peer WireGuard mesh VPN designed from scratch in Go.

Instead of forcing all your network traffic through a single bottleneck server, Knoten establishes direct, end-to-end encrypted mesh tunnels between nodes while keeping the control plane strictly isolated.

Under the Hood & Engineering Highlights:

• Zero-Downtime Live Sync: Peer updates are dynamically pushed to running WireGuard interfaces, modifying routes on the fly without dropping active connections.
• Defensive Storage Engine: Built on pure-Go SQLite (modernc.org/sqlite), meaning zero CGo dependencies and completely static binary compilation. Database persistence uses WAL mode + synchronous = FULL.
• Hardened Security Model: Machine identities are generated locally via Go's crypto/ecdh (X25519). Private keys never leave host memory. The HTTP coordination API features constant-time token verification, strict JSON decoding limits, and middleware panic recovery.
• Crash Resilience & Atomic Writes: Eliminate file corruption during abrupt shutdowns. If the coordinator drops, tunnels stay up while nodes retry via exponential backoff with jitter.
• Minimal Footprint: Compiles down to just two standalone static binaries (coordserver and meshd) and a single database file.

What Works Today (v0.2.0-alpha):

• Automated IP address management (IPAM) across a 10.10.0.0/16 subnet
• Dual operating modes: Coordinated (fleet management) and Standalone (pure static P2P)
• Interactive CLI setup wizard

Roadmap Focus:

• Transitioning from CLI shell-outs to native Go kernel controls via wgctrl-go
• Ephemeral access control (lease-based auto-expiring permissions)
• NAT traversal & encrypted fallback relaying

GitHub: https://github.com/Yacin1102/Knoten

This is a student project, so I’d really appreciate feedback!

so guys i'm planning to buy a raspberry pi with some extra boards in order to create my own vpn for me my family and general all the device we use

at this point i dont know if worth to do something like that

and also i don't know the process to do something like that

or if is better to get a mini pc to block also the trackers and ads

or a specific router that support something like that

or if there is any better solution for something like that

anyone have do something like that ? any opinion? any suggestion?

any advice?

Hi. I am quite new to wireguard/vpn so I need your support. I have set up a wireguard server and I have added a few clients. I have multiple PCs/laptops within my local network but also in remote places.

Remote is quite straight forward - I install wireguard app for Windows 11 and leave it always on - I can surf the web but also access my server remotely.

The issue is with devices which I use both locally and remotely (mobile phones and laptops). I want to have access to my server while being outside (wireguard ON) but wireguard OFF when being locally since I cannot use internet at all when it's ON in my local network for some reason.

How can I achieve that on Windows and Android? I have searched for the solution but only found some 3-4 year old threads which didn't help much.

Mostly informed by this so far: https://docs.gl-inet.com/router/en/4/tutorials/build_your_own_wireguard_home_server_with_two_glinet_routers/

Hi folks, I'm a CRM/system/website admin contractor for a few mom & pop companies and non profits. I'm not technically ignorant but networking has not been my focus area, I mostly just drive applications and do the integration work and build neato reporting dashboards and simple websites.

I live in Mexico but two of my clients are California non profits that share the same managed services vendors. They require me to use a VPN that they reimburse and I'm just so sick of these things, the stability and speed is trash or quickly becomes bad, plus the geolocation often leaks even though the IP address killswitch things are on and sets off my clients threat detection from time to time and I get locked out. Frequent enough to embarrass me as I wait for an unlock on the system I'm the primary admin of..

I was recently recommended to use a hardware vpn, to look into wireguard and tailscale.

So I'm researching and it seems I could use routers, raspberry pi's, etc. I'm wondering on the simplest thing I can do when I visit client offices in November.

What's most common? Using like a raspberry PI as a mini pc to act as a VPN server? Is it easier with a GL router as a server for the VPN? Same device on either side?

Are there any plug and play solutions? I think my goal is basically to disable the connectivity of my laptops' hardware and connect through a travel router with a wireguard tunnel to a vpn server in my clients office.

Neither client has proper IT, I'm basically the do it all IT guy for them but that's like run their websites crms and g-suites and salesforces, not like manage enterprise connectivity or identity. So, I'm hoping to just go plug a device into their literal Cox or ATT or Comcast router whatever it is they have and route all traffic from my laptop through a respective vpn in the client office.

Hey everyone,
I’ve been using Apple TV at home and noticed a lack of lightweight, dedicated WireGuard client apps that can reliably maintain a persistent background connection — especially for tunneling back to a home NAS, router, or private network.
To solve this, I built VPNX Guard, a native tvOS app designed to make managing and maintaining WireGuard tunnels on Apple TV seamless.
Key Features:

• Native tvOS Interface: Optimized for Apple TV remote control navigation.
• Easy Setup: Quick import and management of standard WireGuard configuration files.
• Persistent Keep-Alive: Designed to automatically maintain and reconnect the tunnel in the background.

The app is called VPNX Guard on the tvOS App Store.
I’d love to get feedback from the community on the app or any missing features. Thanks for checking it out!

Hello everyone, im currently using a wireguard vpn server to connect to my homelab services on my phone to go.

The problem stems from my current homelab networking setup, my current router doesnt have an easy way to put my homelab on its own subnet, which makes vpn a little icky.

My home network is a 10.10.10.0/24 network, which are the only allowed IPs in my wireguard config. But since when im at home im connected to the same network via wifi this leads to some connection problems naturally. I mean my wireguard server is on my home network and if my phone tries to connect through wireguard to my wireguard server it wont work.

Did anyone here know of some workaround for this?

I can think of two solutions but dont know of a way to implement it.

I could either

- Find a way to automatically connect and disconnect the wireguard vpn when i connect and disconnect from home wifi

- Or find a way to configure route priority for the wireguard network, so the route to home network always prefer the wifi connection over the tunnel

Hello! Just wanting some advice on this setup.

I was going to do brume 2, and a beryl AX.

Brume setup at my parents house installed on a different coaxial cable than their generic ATT router, and get my own fiber service hooked up and pay for it. Set up wireguard/openVPN. Located in texas.

Beryl AX travel router, with a VPN back to my parents house.

My company mini desktop already has Bluetooth and wifi disabled permanently (as far as im aware) as we cannot use these services and have to hookup by usb dongles for headset and key/mouse.

Will the beryl allow connections from wifi in mexico and allow me to eternity to my company mini desktop fine? I want to live in monterrey, from an apartment with decent wifi speeds around 150mpbs. My company minimum is 60 down and 20 up.

Would this setup be viable?

My parents house is located in austin TX. Monterrey is only a six hour drive.

I have a VPN account with Torguard. Using their "Los Angeles" server and my Windows 11 PC, I can achieve about 850 Mbps up and down through Wireguard using the Windows Wireguard software. I have a symmetrical 1 Gbps connection.

I want to offload the Wireguard duties to a router. I have tested an ASUS router and it will achieve about 250 Mbps up and down. I tried a MikroTik hEX s router and it can barely achieve 90 Mbps. (I had to turn off FastTrack to allow the mangle rules to work.)

So my question is, what router can achieve near line speeds with using Wireguard?

I do not have a need for fancy WiFi features. Not much of a WiFi user except for things that absolutely need WiFi.

Hi,

I'm in China using a Wireguard setup. I connected my Macbook via Ethernet to my GL.inet Slate 7 router (MTU 1200) which is USB tethered to an Iphone SE 3rd generation that uses Nomad eSIM, and Wireguards to my US home. Latency around 300ms.

I had some issues when having a Google Meet with a friend in the US. On Chrome and Edge, my friend cannot see or hear me after I join the meeting, and after a few seconds the meeting ends with message "couldn't start video call because of network error, check firewall settings and try again".

However, it works on Safari (I use Macbook), and we are able to converse. Unfortunately, after awhile (maybe 5 or 10 min?) my friends starts hearing an echo in my voice.

I test it without Wireguard (ie, Iphone SE as a WIFI hotspot and connect my Mac to it), the meeting happens normally on Chrome and Edge. I wonder why.

Does anyone have similar experience and know of a fix?

Thanks

After many many hours on previous setups I found this solution. Maybe you already know, maybe it can help you... No static routes, no broken ICS, no firewall changes

If you are trying to run a WireGuard server directly on a Windows 10 or 11 host to access your local home network (LAN) from your phone or laptop, you've probably hit the classic routing wall: the tunnel connects, but you can't reach any other LAN devices (like NAS, cameras, or local web services).

Windows doesn't perform NAT automatically on WireGuard interfaces, and Windows ICS (Internet Connection Sharing) usually breaks WireGuard's IP subnets.

Instead of adding complex static routes to your home router or every single device on your LAN, the cleanest native solution is to use WinNAT. This forces the Windows host to translate outgoing VPN traffic to its own LAN IP, making all VPN traffic seamlessly accessible across your entire network.

Here is the exact, streamlined setup:

Step 1: Enable PowerShell Network Management
Open PowerShell as Administrator on your Windows Host and run:

Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-Management-PowerShell -All

(If prompted, reboot your PC to finish enabling the feature).

 Step 2: Create the WinNAT Rule In Administrator PowerShell, create a NAT rule matching your WireGuard VPN subnet (e.g., 10.0.0.0/24):
(I named my tunnel WG14-15 therefore)

New-NetNat -Name "WG14-15" -InternalIPInterfaceAddressPrefix "10.0.0.0/24"

Step 3: WireGuard Configurations
above the memo style editor there is box:
Public Key =<SERVER_PUBLIC_KEY> (<---you can send this via e.g. Whatsapp to your phone)

Server Config (host PC e.g. 192.168.1.14):
[Interface]
PrivateKey = <SERVER_PRIVATE_KEY> (you dont need to copy this)
Address = 10.0.0.14/24
ListenPort = 51820

[Peer]
PublicKey = <PHONE_PUBLIC_KEY>
AllowedIPs = 10.0.0.15/32  

Client Config (Phone)
PrivateKey = <PHONE_PUBLIC_KEY>(<---you can send this via e.g. Whatsapp phone-->PC)
[Interface]
PrivateKey = <PHONE_PRIVATE_KEY> (you dont need to copy this)
Address = 10.0.0.15/32
DNS = 1.1.1.1

[Peer]
PublicKey = <SERVER_PUBLIC_KEY>
Endpoint = <YOUR_PUBLIC_IP_OR_DDNS>:51820
AllowedIPs = 192.168.1.0/24, 10.0.0.0/24
PersistentKeepalive = 25

Note: Make sure port 51820 UDP is forwarded on your home router to your Windows host IP (192.168.1.14).

 How it works under the hood Without NAT, packets leave the VPN interface with a 10.0.0.x origin IP. Other LAN devices don't know where to send return packets for 10.0.0.x, so they throw them to the router, which drops them.

WinNAT intercepts all traffic leaving the WireGuard interface and translates the source address to the host PC's local LAN IP (192.168.1.14). To every other device on the network, incoming VPN requests appear to originate directly from the Windows host itself, making full two-way communication work instantly.

Useful Management Commands

Check NAT status: Get-NetNat
Delete NAT rule: Remove-NetNat -Name "WG14-15"
View persitent current routes (you don't need them): route print
Delete a persitent route: To remove a persistent route pointing through a gateway e.g.192.168.1.11, you need to target its destination network address (10.0.0.0), not the gateway IP itself:
route delete -p 10.0.0.0

hi! i have a server running wireguard which i have access to, i installed wireguard on it and the handshakes seemingly failed. i then used a different commercial vpn, connected to wireguard and then disabled the commercial vpn and it worked completely fine

im guessing my isp is blocking wireguard but how do i bypass this?

Apparently, my ISP gives dynamic external IP addresses. How does that work if i want to set up an stable VPN server?

I have two apartments. Let’s call them Apartment A and Apartment B in this example.

I want to leave a smartphone in Apartment B and connect it to the WiFi. When I’m in Apartment A I try to control the smartphone via RustDesk but it fails bc the screen needs to be unlocked :( I even set up a server specifically for this (VPS + Docker)

Now I was thinking of using the travel router (Gl Inet Mango). I was told that it works seamlessly with WireGuard but this is completely new territory for me so I wanted to ask how you would set this up or whether it’s even possible at all?

Please don't get me wrong...those are the two options I know of... maybe you have a different or better idea. A smartphone would be great bc it's simple, has a week's worth of battery life, is easy to carry around, etc.

My home pc is behind CGNAT and I'm using a VPS to connect to home from outside. I have two wg configs on my home pc. The first will allow me to access my LAN remotely through a VPS. The VPS is my exit node in a different country.

I am trying to set up my wg2 confg to allow LAN and be an exit node for my home country. I have two configs on my phone and I plan on switching back and forth for which streaming service I want to use.

My wg2 will not masquerade the wg to local. I can ping the wg ip address of my home pc but I cannot ping or access my LAN. I do have ipv4 forward on both my VPS and my home PC.

My wg2 config file looks like this

[Interface]

Privatekey = home private key

Address = 10.7.0.3/32

MTU = 1280

PostUp = ufw rout allow in on wg2 out on enp6s0

PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp6s0 MASQUERADE

PreDown and PostDown = standard to match above

[Peer]

PublicKey = VPS publickey

AllowedIps = 10.7.0.0/24

Endpoint = VPS endpoint

KeepAlive = 25

My wg1 file only has

ufw route allow in on wg1 out on enp6s0.

My VPS wg2 is allowing my local LAN and my WG Ips

I'm thinking there is a conflict with the home pc trying to access the LAN from two config files. But I don't know where to start.

I’ve been using NetBird for years,
I just got my UX7, it’s great… but
When I try and connect from my phone over cellular… it won’t ping or connect to my devices

Do I need to open a port?

I want to use NetBird still

My goal is to make wireguard a vpn using vless+reality+xtls+uTLS, I am on Windows 11 and I don't have a vps

Hi, I am completely new to the world of VPNs, basically I want to use chatgpt with my windows PC but it is blocked by the country, I tried using other regular vpns by they are cutting the wifi speed by 100x. I have never coded in my entire life and I don't totally understand how wireguard works

VPN providers have servers, each server has an IP adress (like an identity) and they can generate a QR code with this identity, you have to scan the QR code so the information can be processed into a file that you put into your wireguard installer on your PC. Is that right ?

That leads me with other questions: once you do that, do you still have to pay for the VPN subscription ? how do you actually get that information if you a server ? Is there public QR codes of servers that I can use to set up my wireguard?

Thank you very much

PS: I don't really like computers, totally new, if you just want to showcase how dumb I am please refrain yourself from doing so, highly appreciated

hello im trying to add one more tunnel for a new friend but my problem is it doesnt connect but the handshake happens and i did everything exactly the same way i did when i made the other tunnel 6 months ago. yes i updatet wiregaurd to the new version and i tried to delete the new tunnel and made a new one but it still doenst connect to it and i also chnged the ip for the new tunnel but nothing works. also asked chatgpt but he cant help me. also my firewall setting allow all ips.