Peer Configuration

WireGuard config is a tiny file. Example client config:

[Interface]
PrivateKey = <client private key>
Address = 10.0.0.2/32
ListenPort = 51820
DNS = 10.0.0.1

[Peer]
PublicKey = <server public key>
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0    # full tunnel
PersistentKeepalive = 25

Server config:

[Interface]
PrivateKey = <server private key>
Address = 10.0.0.1/32
ListenPort = 51820

[Peer]
PublicKey = <client_1 public key>
AllowedIPs = 10.0.0.2/32

[Peer]
PublicKey = <client_2 public key>
AllowedIPs = 10.0.0.3/32

Each peer:

• PublicKey: peer's static public key. Used to authenticate.
• AllowedIPs: source/destination IPs allowed for this peer (cryptographic routing). Inbound: only accept packets from this peer if they claim source IP within AllowedIPs. Outbound: route packets to this peer if their dest is within.
• Endpoint: peer's UDP address (optional; learned dynamically from inbound).
• PersistentKeepalive: send empty packet every N seconds to keep NAT mapping alive.

Cryptographic routing is unique to WireGuard. The "routing table" is part of crypto: only this peer can produce packets claiming this source IP.

Compare to OpenVPN/IPsec:

• Heavyweight ACLs, separate auth + routing.
• Lots of config knobs.
• WireGuard intentionally minimal.

NAT traversal:

• Client behind NAT: NAT maps client_local_port → public_port for outbound.
• Outbound packet teaches server the client's current external endpoint.
• Server replies to learned endpoint.
• PersistentKeepalive keeps NAT mapping alive.

Tailscale extends WireGuard with a coordination plane:

• Magic IP: each device gets a stable IP regardless of network.
• DERP relays: for peers that can't connect directly.
• ACLs in centralized config.