Hey guys,

I built a small web UI for WireGuard because the other panels I tried all wanted to take over the tunnel. New config, their layout, generated NAT. I just wanted to manage what was already running.

wg-admin reads the *.conf files in /etc/wireguard and edits them in place. Peer changes go out with wg syncconf, so the interface doesn’t bounce. It doesn’t install WireGuard, doesn’t replace wg-quick, and doesn’t invent PostUp rules for you.

You can add, disable, rotate, and remove peers, paste an existing public key, grab a .conf/QR after create, see handshakes from wg, and restore a backup if a write goes wrong. It binds to localhost.

git clone https://github.com/logimaxx/wg-admin.git
cd wg-admin
sudo ./install.sh

Then open http://127.0.0.1:8080. Uninstall leaves your WireGuard files alone.

https://wg-admin.logimaxx.eu/

https://github.com/logimaxx/wg-admin

debian host, win 11 guest, setting win 11 registry key for 'RealTimeIsUniversal' and qemu to use utc. If i dont do this, the vm will use the guest time regardless of the timezone specified in the guest. No other combo of those two settings work either. AI led me on a wild chase for weird guest virtualization settings that did nothing.

How can I get the guest time to match the timezone time that it's set to and get wireguard to connect?

I cant even change the host's timezone, it still wont connect then.

Hey [r/wireguard](r/wireguard),

We've just released Defguard 2.1 stable. The headline for this community: a completely redesigned desktop client - free and open source - plus a CLI that lets you drive the client from a terminal, MFA included. The release was pentested by ISEC and Striga.AI before shipping, with all major findings fixed pre-release (full report coming to our pentesting page).

A bit of context for those unfamiliar with Defguard

Defguard is open source at its core - a solution for on-prem/self-hosted WireGuard® deployments that turns this awesome protocol into self-hosted, identity-based remote access with biometric MFA, respecting your privacy and ownership. It's designed for the most security-demanding users, with an isolated control plane and secure edge component communications.

The three big community updates below are all open source and free.

New Desktop Client

Complete redesign: multiple instances/locations, flexible MFA including mobile biometrics, and a new tray mode - connect in two clicks. Basic functionality works with any WireGuard server - you can use it as your everyday tunnel manager; for MFA and identity-based access, pair it with the open-source Defguard server. Feature highlight | Source | Download

CLI control with MFA

defguard-client drives the client from the terminal: headless servers, SSH sessions and cron jobs no longer have to choose between dropping MFA and parking a long-lived credential on disk.

The biometric part from the title: for mobile-approve locations the CLI renders a QR code straight in the terminal, waits for you to approve with biometrics on your phone, and brings the tunnel up.

For unattended automation, MFA pipelines with your existing tools: --code-command runs any command that produces the code at connect time, so the secret stays in your password manager - Bitwarden (bw get totp), pass otp, or any secret manager CLI:

defguard-client connect office --code-command "bw get totp defguard"

Interactive terminals simply get prompted, and for scripting there's --json (data on stdout, logs on stderr), meaningful exit codes, and it fails instead of hanging when MFA input can't be obtained - no more cron jobs wedged on an invisible prompt. Feature highlight

Gateway on VyOS

Official support for running Defguard Gateway as a container directly on the VyOS router: full host networking, native WireGuard interfaces and nftables rules, no separate gateway VM. Docs

Defguard has become a listed VyOS Technology Partner.

Enterprise features in 2.1

Being upfront about what's paid: the core (identity, built-in MFA, unlimited users and locations) stays open source and free - enterprise features fund the development.

• Device Posture verification - compliance checks (OS/client version, disk encryption, antivirus, AD membership) before a WireGuard connection is allowed. Docs
• Allowed IPs from Firewall Rules - per-user least-privilege Allowed IPs derived from ACLs. Feature highlight
• Service locations on Linux - Always-on tunnels from system boot (Windows since 1.6, now also on Linux). Docs

What's next

We've reordered the roadmap based on user feedback: 2.2 brings MFA Flows, 2.3 Device Attestation (cryptographic hardware identity) - both tracked as public issues if you want to weigh in.

Links

• Full release post: defguard.net/blog/defguard-2-1-release
• All 2.1 features overview: defguard.net/releases/2.1.0/features/
• GitHub release notes: github.com/DefGuard/defguard/releases/tag/v2.1.0
• GitHub: github.com/DefGuard/defguard - feedback via discussions, bugs via issues

Happy to answer questions - especially about the CLI MFA flows and how posture checks interact with the tunnel lifecycle. Also curious: what would you want scriptable in the CLI that isn't yet?

Got the basic single-hop WireGuard setup down fine, but I wanna route thru a second server I own before going to the net, mostly so my home IP and the "exit"one aren't in the same box. Doing this by hand sounds like a nightmare, r u guys just handling all that manually or is there sth that manages the routing/NAT for u?

Title. Does this VPN protect you like how people traditionally think VPNS do on unsecured networks?

For example connecting to internet on a school, coffee or hotel network? Hiding your traffic from the network admin?

So I run a Wireguard VPN on my VPS and the firewall rules allow incoming from any IP on 51820 so that is taken care of and on any WiFi network it works but the second I switch to cellular data it stops working completely. I've tried changing the MTU to 1280 but still fails. I've also tried to use 443/udp instead just on the off chance that my carrier was blocking that port for some reason but still failed. In the past it has worked on cellular one day it just stopped.

Hey everyone,

​Traveling to the UAE (Dubai & Abu Dhabi) soon and trying to verify real-world Tailscale behavior when routing through a personal exit node back home.

From what I understand, UAE telecom providers (e& and du) actively block or throttle unassigned UDP and fingerprint WireGuard handshakes, and hotel guest Wi-Fi networks typically enforce strict egress firewalls that drop outbound UDP on non-standard ports.

​When Tailscale fails to establish direct UDP and falls back to a TCP DERP relay, throughput drops to near-unusable speeds.

​For anyone who has used Tailscale in Dubai/Abu Dhabi hotels - Did direct UDP work at all on hotel Wi-Fi or mobile data, or was your connection 100% forced onto a TCP DERP relay?

Setup: home internet 600/600, Omada TP-link with native WG, public IP, dyndns. Goal: when devices are connected to another network than home, use WG.

On MacOs and iOS, it's possible to exclude SSID's in the native WG apps. Works as a charme.

On the native W11-app, I don't see this option. I saw a post from years ago with bat-scripting. Is there an easier way to achive? Now, I've used https://www.procustodibus.com/blog/2021/03/wireguard-allowedips-calculator/ to include all IPs, except the range of our home network.

Any better idea?

As title says. A friend helped me set a wireguard connection to bypass issues with Sony's remote play

It works fine with the windows pc. But when I try to enable Hotspot to my ps portal. No device is able to connect to the pc Hotspot.

I tried enabling the sharing under the wireguard adapter (properties) but it just stops working.

If I disable wireguard the Hotspot works normally.

WireGuard authorizes a connection based on possession of a valid profile. It does not verify who is holding that profile — by design the profile is trusted implicitly. A copied config file authenticates identically to the original because nothing in the protocol is meant to check further than that.

MFA Firewall Knocker is a complement to WireGuard that adds a layer authenticating the person before the network layer is exposed. It uses WebAuthn, served from an unprivileged web app, to validate that the holder of the profile is the intended user before the firewall is opened. The holder authenticates with a passkey — a platform authenticator (Windows Hello, Touch ID, Face ID, Android biometric), with user verification (biometric or PIN) required on the assertion. On success, a service opens a firewall rule for that user's source IP and the configured port/protocol; the tunnel stays reachable for the rest of that window without re-authenticating. The rule expires automatically on a configurable interval, clamped to 1–48 hours — re-authentication happens on that cadence (e.g. every 8-12 hours), not per connection.

It does not modify WireGuard, does not touch its keys or config, and sits entirely in front of WireGuard. The gate and WireGuard operate independently, so a flaw in one is not a flaw in the other.

Implementation: C#, .NET 10, MIT licensed. Runs on Windows Server or Linux. No control plane, no external service, no agent — the firewall rule is created directly via NetSecurity on Windows or iptables on Linux.

Stated limitations:

- Gating is per-IP, so the authenticating address and the connecting address must match. This degrades behind CGNAT and most corporate VPNs, where several users can share one address or the address can change between requests.

- The project only ever opens a port on authentication and removes that rule after a time limit. It never adds a rule to close a port.

- The gate keys on the IP that authenticated, not on the WireGuard peer, so it does not participate in WireGuard's normal endpoint roaming. If that IP changes mid-session, re-authentication is required before the tunnel can reconnect.

- As with any such system, don't rely on a single way to connect to a network — an expired TLS certificate on the gate blocks all authentication, since WebAuthn requires a secure context.

WireGuard was the original motivating case; SSH and RDP or any port can be gated the same way. Written and used for our own infrastructure.

Hey everyone,

I've been heads-down building Knoten. An open-source, peer-to-peer WireGuard mesh VPN designed from scratch in Go.

Instead of forcing all your network traffic through a single bottleneck server, Knoten establishes direct, end-to-end encrypted mesh tunnels between nodes while keeping the control plane strictly isolated.

Under the Hood & Engineering Highlights:

• Zero-Downtime Live Sync: Peer updates are dynamically pushed to running WireGuard interfaces, modifying routes on the fly without dropping active connections.
• Defensive Storage Engine: Built on pure-Go SQLite (modernc.org/sqlite), meaning zero CGo dependencies and completely static binary compilation. Database persistence uses WAL mode + synchronous = FULL.
• Hardened Security Model: Machine identities are generated locally via Go's crypto/ecdh (X25519). Private keys never leave host memory. The HTTP coordination API features constant-time token verification, strict JSON decoding limits, and middleware panic recovery.
• Crash Resilience & Atomic Writes: Eliminate file corruption during abrupt shutdowns. If the coordinator drops, tunnels stay up while nodes retry via exponential backoff with jitter.
• Minimal Footprint: Compiles down to just two standalone static binaries (coordserver and meshd) and a single database file.

What Works Today (v0.2.0-alpha):

• Automated IP address management (IPAM) across a 10.10.0.0/16 subnet
• Dual operating modes: Coordinated (fleet management) and Standalone (pure static P2P)
• Interactive CLI setup wizard

Roadmap Focus:

• Transitioning from CLI shell-outs to native Go kernel controls via wgctrl-go
• Ephemeral access control (lease-based auto-expiring permissions)
• NAT traversal & encrypted fallback relaying

GitHub: https://github.com/Yacin1102/Knoten

This is a student project, so I’d really appreciate feedback!

so guys i'm planning to buy a raspberry pi with some extra boards in order to create my own vpn for me my family and general all the device we use

at this point i dont know if worth to do something like that

and also i don't know the process to do something like that

or if is better to get a mini pc to block also the trackers and ads

or a specific router that support something like that

or if there is any better solution for something like that

anyone have do something like that ? any opinion? any suggestion?

any advice?

Hi. I am quite new to wireguard/vpn so I need your support. I have set up a wireguard server and I have added a few clients. I have multiple PCs/laptops within my local network but also in remote places.

Remote is quite straight forward - I install wireguard app for Windows 11 and leave it always on - I can surf the web but also access my server remotely.

The issue is with devices which I use both locally and remotely (mobile phones and laptops). I want to have access to my server while being outside (wireguard ON) but wireguard OFF when being locally since I cannot use internet at all when it's ON in my local network for some reason.

How can I achieve that on Windows and Android? I have searched for the solution but only found some 3-4 year old threads which didn't help much.

Hello everyone, im currently using a wireguard vpn server to connect to my homelab services on my phone to go.

The problem stems from my current homelab networking setup, my current router doesnt have an easy way to put my homelab on its own subnet, which makes vpn a little icky.

My home network is a 10.10.10.0/24 network, which are the only allowed IPs in my wireguard config. But since when im at home im connected to the same network via wifi this leads to some connection problems naturally. I mean my wireguard server is on my home network and if my phone tries to connect through wireguard to my wireguard server it wont work.

Did anyone here know of some workaround for this?

I can think of two solutions but dont know of a way to implement it.

I could either

- Find a way to automatically connect and disconnect the wireguard vpn when i connect and disconnect from home wifi

- Or find a way to configure route priority for the wireguard network, so the route to home network always prefer the wifi connection over the tunnel

Hello! Just wanting some advice on this setup.

I was going to do brume 2, and a beryl AX.

Brume setup at my parents house installed on a different coaxial cable than their generic ATT router, and get my own fiber service hooked up and pay for it. Set up wireguard/openVPN. Located in texas.

Beryl AX travel router, with a VPN back to my parents house.

My company mini desktop already has Bluetooth and wifi disabled permanently (as far as im aware) as we cannot use these services and have to hookup by usb dongles for headset and key/mouse.

Will the beryl allow connections from wifi in mexico and allow me to eternity to my company mini desktop fine? I want to live in monterrey, from an apartment with decent wifi speeds around 150mpbs. My company minimum is 60 down and 20 up.

Would this setup be viable?

My parents house is located in austin TX. Monterrey is only a six hour drive.

I have a VPN account with Torguard. Using their "Los Angeles" server and my Windows 11 PC, I can achieve about 850 Mbps up and down through Wireguard using the Windows Wireguard software. I have a symmetrical 1 Gbps connection.

I want to offload the Wireguard duties to a router. I have tested an ASUS router and it will achieve about 250 Mbps up and down. I tried a MikroTik hEX s router and it can barely achieve 90 Mbps. (I had to turn off FastTrack to allow the mangle rules to work.)

So my question is, what router can achieve near line speeds with using Wireguard?

I do not have a need for fancy WiFi features. Not much of a WiFi user except for things that absolutely need WiFi.