What is the difference between the wg and wg-quick keys?

The low-level wg command understands only the cryptographic and routing keys: PrivateKey, ListenPort, FwMark, PublicKey, AllowedIPs, Endpoint, PersistentKeepalive and PresharedKey. Keys like Address, DNS, MTU, Table and the Pre/Post Up/Down hooks are extensions interpreted by the wg-quick wrapper script.

What does AllowedIPs actually control?

AllowedIPs is a cryptokey routing table. Inbound, it filters which source addresses are accepted from a peer; outbound, it decides which destination addresses are routed into the tunnel to that peer. Setting it to 0.0.0.0/0 and ::/0 routes all traffic through the peer, turning it into a full VPN.

When do I need PersistentKeepalive?

Set it, typically to 25 seconds, when a peer sits behind NAT and needs to keep its mapping open so the other side can reach it. Without keepalives a NAT entry expires after idle time and the inbound connection silently breaks. It is unnecessary for peers with a stable public endpoint.

Is the Endpoint key required?

No. A peer that only ever initiates connections (a roaming client) needs an Endpoint to know where to send packets, but a server peer that only receives can omit it because WireGuard learns the remote endpoint from the first valid packet.

What is PresharedKey for?

PresharedKey adds an optional symmetric key mixed into the handshake, providing an extra layer of post-quantum resistance on top of the public-key cryptography. Generate it with wg genpsk and configure the same value on both peers.

What is the WireGuard Config Reference?

Reference for WireGuard configuration file keys across the Interface and Peer sections, covering PrivateKey, Address, DNS, AllowedIPs, Endpoint, PersistentKeepalive and the wg-quick extensions. It runs free in your browser on Gera Tools, with nothing uploaded.

WireGuard Config Reference

Name: WireGuard Config Reference
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

The WireGuard configuration file

A WireGuard tunnel is described by a small INI-style .conf file with one [Interface] section for the local node and one or more [Peer] sections for the remote ends. This reference lists every common key, its type, whether it is required, and which keys are wg-quick extensions rather than core wg options.

How it works

The [Interface] section holds this node’s identity and (via wg-quick) its IP and routing setup; each [Peer] defines a remote node, its public key, the IPs it owns, and how to reach it:

[Interface]
PrivateKey = <client private key>
Address = 10.0.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = <server public key>
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

AllowedIPs is the heart of WireGuard’s cryptokey routing: it doubles as an inbound source filter and an outbound route. Keys such as Address, DNS and the PostUp/PostDown hooks are applied by the wg-quick wrapper.

Key-by-key reference

[Interface] keys

Key	wg-quick only	Required	Type	Notes
PrivateKey	No	Yes	Base64 key	This node’s private key. Generate with `wg genkey`.
ListenPort	No	No	Integer	UDP port to listen on. If omitted, wg assigns a random port.
FwMark	No	No	Hex/integer	Firewall mark on outgoing packets; used to exempt tunnel traffic from policy routing.
Address	Yes	Yes*	CIDR	IP address(es) of this node’s tunnel interface. *Required by wg-quick.
DNS	Yes	No	IP(s)	DNS servers to configure while the tunnel is up.
MTU	Yes	No	Integer	Interface MTU. Default auto-detects; WireGuard overhead is ~60 bytes, so typical values are 1420 for IPv4 or 1380 for IPv6.
Table	Yes	No	Integer/off	Routing table. `off` disables route insertion; `auto` is the default.
PreUp/PostUp	Yes	No	Shell command	Run before/after `wg-quick up`. Useful for firewall rules (`iptables`).
PreDown/PostDown	Yes	No	Shell command	Run before/after `wg-quick down`.

[Peer] keys

Key	wg-quick only	Required	Type	Notes
PublicKey	No	Yes	Base64 key	The remote peer’s public key.
AllowedIPs	No	Yes	CIDR list	Routes for this peer (outbound) and accepted source IPs (inbound).
Endpoint	No	No	host:port	Where to send packets. Required for the initiating side; a server can omit it.
PersistentKeepalive	No	No	Seconds	Send a keepalive every N seconds to hold NAT mappings. Commonly 25.
PresharedKey	No	No	Base64 key	Optional symmetric key for post-quantum defence. Generate with `wg genpsk`.

Minimal configurations by role

Full-tunnel VPN client:

[Interface]
PrivateKey = <client private key>
Address = 10.0.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = <server public key>
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0, ::/0   # route ALL traffic through VPN
PersistentKeepalive = 25

Split-tunnel client (only corporate subnet):

[Interface]
PrivateKey = <client private key>
Address = 10.0.0.2/32

[Peer]
PublicKey = <server public key>
Endpoint = vpn.example.com:51820
AllowedIPs = 10.0.0.0/8         # only internal traffic goes through VPN
PersistentKeepalive = 25

Server (multi-peer):

[Interface]
PrivateKey = <server private key>
Address = 10.0.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = <client-A public key>
AllowedIPs = 10.0.0.2/32        # this client's tunnel IP

[Peer]
PublicKey = <client-B public key>
AllowedIPs = 10.0.0.3/32

Tips and notes

A minimal client needs PrivateKey + Address plus a peer with PublicKey, AllowedIPs and Endpoint.
Use AllowedIPs = 0.0.0.0/0, ::/0 for a full-tunnel VPN; list specific subnets for split tunnelling.
Add PersistentKeepalive = 25 on peers behind NAT to keep the path open.
Keys flagged wg-quick only will be ignored if you configure the interface directly with wg setconf.
Generate a key pair with: wg genkey | tee privatekey | wg pubkey > publickey.