Standalone tool · No ads or analytics

WireGuard config generator

Create matching server and client configs for a WireGuard VPN with one server and several clients.

Keys and configs are generated in this page’s memory with the browser’s Web Crypto API. Nothing is sent to a server or saved in browser storage. Download the configs before you leave, or clear the outputs when you finish.

Listen portNumber of clients1 to 250 clients.IPv4 tunnel networkCIDR format. The server gets the first address; the clients get the next addresses.IPv6 tunnel network (optional)For example fd00:0:0:1::/64. Leave empty for IPv4 only.Client allowed IPs0.0.0.0/0, ::/0 sends all client traffic through the tunnel. Use the tunnel networks for a split tunnel.Endpoint (optional)Public host name or IP address of the server, with an optional port. Without a port, the listen port applies.DNS (optional)Comma-separated DNS servers for the clients.PostUp rule (optional)PostDown rule (optional)wg-quick runs these shell commands as root on the server. Replace eth0 with the internet interface of the server. For IPv6, add matching ip6tables rules.

Add a preshared key for each clientAn additional symmetric key on each server-client pair. It adds a layer of protection.