# WireGuard example configs

Example server and client configs for a point-to-point WireGuard tunnel. The keys are samples only; do not use them in production.

| File | Role | Tunnel address |
| --- | --- | --- |
| `server.conf` | Server, listens on UDP 51820 | `192.168.200.1/24` |
| `client.conf` | Client, routes all traffic (`0.0.0.0/0`) through the server | `192.168.200.2/24` |

## Usage

1. Replace the keys with your own (`wg genkey | tee private.key | wg pubkey`), and set the client's `Endpoint` to the server's address.
2. On the server, bring up the interface and register the client as a peer:

   ```sh
   wg-quick up wg0
   sudo wg set wg0 peer <client-public-key> allowed-ips 192.168.200.2/32
   sudo systemctl enable wg-quick@wg0.service
   ```

3. To let the client reach the outside through the server, enable forwarding and NAT:

   ```sh
   sudo sysctl net.ipv4.ip_forward=1
   sudo nft add table ip nat
   sudo nft -- add chain ip nat POSTROUTING { type nat hook postrouting priority srcnat \; }
   sudo nft add rule ip nat POSTROUTING ip saddr 192.168.200.0/24 masquerade
   ```

4. On the client: `wg-quick up client` (the file name is the interface name).