cloudhost/wireguard

WireGuard example configs

Example server and client configs for a point-to-point WireGuard tunnel. The keys are samples only; do not use them in production.

File	Role	Tunnel address
server.conf	Server, listens on UDP 51820	192.168.200.1/24
client.conf	Client, routes all traffic (0.0.0.0/0) through the server	192.168.200.2/24

Usage

1. Replace the keys with your own (wg genkey | tee private.key | wg pubkey), and set the client's Endpoint to the server's address.

2. On the server, bring up the interface and register the client as a peer:

   wg-quick up wg0
   sudo wg set wg0 peer <client-public-key> allowed-ips 192.168.200.2/32
   sudo systemctl enable wg-quick@wg0.service
   

3. To let the client reach the outside through the server, enable forwarding and NAT:

   sudo sysctl net.ipv4.ip_forward=1
   sudo nft add table ip nat
   sudo nft -- add chain ip nat POSTROUTING { type nat hook postrouting priority srcnat \; }
   sudo nft add rule ip nat POSTROUTING ip saddr 192.168.200.0/24 masquerade
   

4. On the client: wg-quick up client (the file name is the interface name).