Skip to content

# WireGuard

Since sing-box 1.11.0

### Structure

    {
      "type": "wireguard",
      "tag": "wg-ep",

      "system": false,
      "name": "",
      "mtu": 1408,
      "address": [],
      "private_key": "",
      "listen_port": 10000,
      "peers": [
        {
          "address": "127.0.0.1",
          "port": 10001,
          "public_key": "",
          "pre_shared_key": "",
          "allowed_ips": [],
          "persistent_keepalive_interval": 0,
          "reserved": [0, 0, 0]
        }
      ],
      "udp_timeout": "",
      "workers": 0,

      ... // Dial Fields
    }

You can ignore the JSON Array [] tag when the content is only one item

### Fields

#### system

Use system interface.

Requires privilege and cannot conflict with exists system interfaces.

#### name

Custom interface name for system interface.

#### mtu

WireGuard MTU.

`1408` will be used by default.

#### address

Required

List of IP (v4 or v6) address prefixes to be assigned to the interface.

#### private_key

Required

WireGuard requires base64-encoded public and private keys. These can be generated using the wg(8) utility:

    wg genkey
    echo "private key" || wg pubkey

or `sing-box generate wg-keypair`.

#### peers

Required

List of WireGuard peers.

#### peers.address

WireGuard peer address.

#### peers.port

WireGuard peer port.

#### peers.public_key

Required

WireGuard peer public key.

#### peers.pre_shared_key

WireGuard peer pre-shared key.

#### peers.allowed_ips

Required

WireGuard allowed IPs.

#### peers.persistent_keepalive_interval

WireGuard persistent keepalive interval, in seconds.

Disabled by default.

#### peers.reserved

WireGuard reserved field bytes.

#### udp_timeout

UDP NAT expiration time.

`5m` will be used by default.

#### workers

WireGuard worker count.

CPU count is used by default.

### Dial Fields

See Dial Fields for details.