Home > Docs > OpenBSD > Wireguard
How to configure a wireguard endpoint on OpenBSD
Tags: OpenBSD vpn


OpenBSD does things elegantly as usual : where linux distributions have a service, OpenBSD has a simple /etc/hostname.wg0 file. The interface is therefore managed without any tool other than the standard ifconfig, it’s so simple and elegant!

Configuration example

Here is a configuration example to create a tunnel listening on udp port 342 and several peers :

wgport 342 wgkey '4J7O3IN7+MnyoBpxqDbDZyAQ3LUzmcR2tHLdN0MgnH8='
wgpeer 'LWZO5wmkmzFwohwtvZ2Df6WAvGchcyXpzNEq2m86sSE=' wgaip
wgpeer 'SjqCIBpTjtkMvKtkgDFIPJsAmQEK/+H33euekrANJVc=' wgaip
wgpeer '4CcAq3xqN496qg2JR/5nYTdJPABry4n2Kon96wz981I=' wgaip
wgpeer 'vNNic3jvXfbBahF8XFKnAv9+Cef/iQ6nWxXeOBtehgc=' wgaip

Your private key goes on the first line as argument to wgkey, the other keys are public keys for each peer.

To re-read the interface configuration, use :

sh /etc/netstart wg0


Private keys can be generated with the following command :

openssl rand -base64 32

The tunnel can be managed with the standard ifconfig command:

root@yen:~# ifconfig wg0
        index 4 priority 0 llprio 3
        wgport 342
        wgpubkey R4A01RXXqRJSY9TiKQrZGR85HsFNSXxhRKKEu/bEdTQ=
        wgpeer LWZO5wmkmzFwohwtvZ2Df6WAvGchcyXpzNEq2m86sSE=
                wgendpoint 1024
                tx: 158515972, rx: 151576036
                last handshake: 93 seconds ago
        wgpeer SjqCIBpTjtkMvKtkgDFIPJsAmQEK/+H33euekrANJVc=
                wgendpoint 51110
                tx: 30969024, rx: 14034688
                last handshake: 9527 seconds ago
        wgpeer 4CcAq3xqN496qg2JR/5nYTdJPABry4n2Kon96wz981I=
                wgendpoint 46247
                tx: 36877516, rx: 19036472
                last handshake: 23 seconds ago
        wgpeer vNNic3jvXfbBahF8XFKnAv9+Cef/iQ6nWxXeOBtehgc=
                wgendpoint 1025
                tx: 150787792, rx: 146836696
                last handshake: 43 seconds ago
        groups: wg
        inet netmask 0xffffff00 broadcast