WireGuard Config Generator
The WireGuard config generator builds a server wg0.conf, one config per peer and a server setup script, then checks the result for IPv6 and DNS leaks, subnet clashes and routing loops. It is for anyone setting up their own WireGuard server.
X25519 keys are made with Web Crypto in this tab. Nothing you type or generate is sent anywhere.
Options subnets, DNS, routing, firewall, names
No configs yet
Add the server's hostname or IP, or pick a preset.
Check a key: derive a public key, verify a pair
wg pubkey, done with Web Crypto in this tab.How the generator works
The page makes one X25519 key pair for the server and one per peer with the browser's Web Crypto API, plus a 32-byte preshared key per peer when that option is on. Every key is checked to decode to exactly 32 bytes before any file is shown.
- wg0.conf gives the server the first host address in the VPN subnet and lists every peer's public key. Server side AllowedIPs is each peer's own /32 and /128.
- Peer configs carry that peer's private key, an Address, DNS, the server's public key, the Endpoint, AllowedIPs (the route and the return filter) and PersistentKeepalive.
- The setup script installs wireguard-tools for Debian or Ubuntu, Fedora or RHEL, or Alpine, turns on forwarding, opens the UDP port and adds NAT with nftables, iptables, ufw or firewalld, then brings wg0 up on boot.
- The bundle is one shell script that writes wg0.conf, the setup script and every peer config into the current directory with umask 077.
Changing options keeps the keys. New keys replaces all of them. For a production server you can also run wg genkey | tee privatekey | wg pubkey > publickey on the box and paste only public halves.
How to read the checks
Each generated set is checked against rules for leaks, routing and reachability. Open a row to see the rule and the fix.
- Fix (red): wg-quick will reject the file, traffic leaks outside the tunnel, or packets loop. Examples: AllowedIPs entries wg cannot parse, IPv4 routed with no IPv6, an endpoint inside AllowedIPs, a public VPN subnet.
- Check (amber): it works, with a known side effect. Examples: a VPN subnet that overlaps a common home LAN, DNS resolvers outside AllowedIPs, keepalive off, an MTU too big for a 1500 byte path.
- Info and ok: notes on choices such as a hostname endpoint or the default port, and rules that passed.
WireGuard has no exclude syntax. To keep one range out of a full tunnel, use the AllowedIPs calculator. Keepalive matters only for peers behind NAT, which drops idle UDP mappings after about 30 seconds.
FAQ
Are the private keys sent anywhere?
No. Key pairs are made with the Web Crypto API (X25519) and preshared keys with crypto.getRandomValues, all inside this tab. The page has no server step for keys, so the only copies are the files you copy or download.
What happens if my browser has no X25519 support?
X25519 in Web Crypto needs Chrome 133, Firefox 132 or later. Without it the page still makes clamped private keys, but every PublicKey line is a placeholder. Run wg pubkey on the matching private key to fill it in.
Does changing an option replace my keys?
No. Options re-render with the same keys, so a config already copied to a device stays valid. Raising the peer count adds keys for the new peers. Only the New keys button replaces the whole set.
Why does an IPv4 only setup route ::/0?
With Block IPv6 leak on and no IPv6 subnet, peers route ::/0 into the tunnel. The server has nowhere to send it, so IPv6 traffic is dropped instead of leaving outside the tunnel with the device's real address.
What does the setup script do on the server?
It installs wireguard-tools, places wg0.conf with mode 600, turns on IP forwarding, opens the UDP port and adds forwarding and masquerade rules for the firewall you picked, saves them for reboot, then enables wg-quick for wg0 and runs wg show.
Format per WireGuard and the wg-quick man page. X25519 keys via the Web Crypto API. Part of the pwnsy VPN tools.