WireGuard¶
A WireGuard tunnel behaves like any other interface once it is up: you route to it and write firewall rules against it. Use it wherever both ends are under your control; use IPsec for equipment that does not speak WireGuard.
Where:
- Connectivity > VPN tunnels lists every tunnel on the gateway, worst first, with its state, Far end and Networks reached. Edit configuration opens the tunnel's form.
- Connectivity > Interfaces & network > + Add Interface > WireGuard creates one by hand. Create a tunnel on an empty VPN tunnels page goes to the Integrations catalogue, which builds a tunnel with its rules.
Creating a tunnel¶
| Field | Meaning |
|---|---|
| Name | e.g. wg0 |
| Listen Port | The UDP port this gateway listens on |
| Address (CIDR) | The tunnel's own address |
| Peers | + Add Peer for each far end: Public Key, Endpoint, Allowed IPs, Keepalive (s) |
| Description | Optional label, shown as the tunnel's name on VPN tunnels |
Click Create WireGuard, then apply and confirm.
- Endpoint may be left blank for a peer that connects to this gateway.
- Keepalive (s) at
0means none; set it when this gateway is behind NAT and must hold the path open. - A peer row with no public key is ignored on save.
Keys¶
The private key is generated on the gateway and never leaves it. Its public key appears once the tunnel has come up:
- Create the tunnel and apply it.
- Wait for the device to report the interface.
- Reopen the tunnel: This gateway's public key is shown with a Copy button. Until then the form says Not known yet.
- Give that key to the other side.
The key is also shown on the interface row.
Editing a tunnel¶
The edit form (Edit WireGuard — wg0) has the listen port, addresses, MTU, description and the peer list, so peers can be added, changed and removed. It also shows Reported peers: what the device actually has configured, with Public Key, State, Last handshake, Traffic (rx / tx) and Endpoint.
A peer you added that is missing from Reported peers has not been applied by the device. Peer state arrives with the device's regular report, so it lags by up to one reporting interval.
Tunnel state¶
| State | Meaning |
|---|---|
| Up · traffic | A peer handshaked in the last 180 s and data has crossed |
| Up · idle | Negotiated, but no packet has crossed yet — usually routing or firewall |
| Stale | It worked and has gone quiet (no handshake for 180 s) |
| Never connected | The far end has never answered: check the public key, the endpoint, and that UDP reaches this gateway |
| Incomplete | No peer is configured |
| Unknown | The gateway has not reported on this tunnel |
Making traffic flow¶
- Traffic to the remote network needs a route pointing at the tunnel, unless the peer's Allowed IPs already cover it.
- Traffic crossing the tunnel is filtered by the Security policy like anything else.
To confirm end to end, Diagnostics > Ping an address on the far side.