Wireguard

`networking.wireguard.enable`

Whether to enable WireGuard.

Please note that {option}systemd.network.netdevs has more features and is better maintained. When building new things, it is advised to use that instead.

Type: boolean

Default

config.networking.wireguard.interfaces != { }

Example

true

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces`

WireGuard interfaces.

Please note that {option}systemd.network.netdevs has more features and is better maintained. When building new things, it is advised to use that instead.

Type: attribute set of (submodule)

Default

{ }

Example

{wg0 = {ips = ["192.168.20.4/24"];peers = [{allowedIPs = ["192.168.20.1/32"];endpoint = "demo.wireguard.io:12913";publicKey = "xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=";}];privateKey = "yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk=";};}

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.allowedIPsAsRoutes`

Determines whether to add allowed IPs as routes or not.

Type: boolean

Default

true

Example

false

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.fwMark`

Mark all wireguard packets originating from this interface with the given firewall mark. The firewall mark can be used in firewalls or policy routing to filter the wireguard packets. This can be useful for setup where all traffic goes through the wireguard tunnel, because the wireguard packets need to be routed differently.

Type: null or string

Default

null

Example

"0x6e6978"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.generatePrivateKeyFile`

Automatically generate a private key with {command}wg genkey, at the privateKeyFile location.

Type: boolean

Default

false

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.interfaceNamespace`

The pre-existing network namespace the WireGuard interface is moved to. The special value init means the init namespace. When null, the interface is not moved. See documentation.

Type: null or string

Default

null

Example

"init"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.ips`

The IP addresses of the interface. Type: list of string

Default

[ ]

Example

["192.168.2.1/24"]

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.listenPort`

16-bit port for listening. Optional; if not specified, automatically generated based on interface name.

Type: null or signed integer

Default

null

Example

51820

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.metric`

Set the metric of routes related to this Wireguard interface.

Type: null or signed integer

Default

null

Example

700

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.mtu`

Set the maximum transmission unit in bytes for the wireguard interface. Beware that the wireguard packets have a header that may add up to 80 bytes to the mtu. By default, the MTU is (1500 - 80) = 1420. However, if the MTU of the upstream network is lower, the MTU of the wireguard network has to be adjusted as well.

Type: null or signed integer

Default

null

Example

1280

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.peers`

Peers linked to the interface. Type: list of (submodule)

Default

[ ]

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.peers.*.allowedIPs`

List of IP (v4 or v6) addresses with CIDR masks from which this peer is allowed to send incoming traffic and to which outgoing traffic for this peer is directed. The catch-all 0.0.0.0/0 may be specified for matching all IPv4 addresses, and ::/0 may be specified for matching all IPv6 addresses. Type: list of string

Example

["10.192.122.3/32""10.192.124.1/24"]

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.peers.*.dynamicEndpointRefreshRestartSeconds`

When the dynamic endpoint refresh that is configured via dynamicEndpointRefreshSeconds exits (likely due to a failure), restart that service after this many seconds.

If set to null the value of {option}networking.wireguard.dynamicEndpointRefreshSeconds will be used as the default.

Type: null or (unsigned integer, meaning >=0)

Default

null

Example

5

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.peers.*.dynamicEndpointRefreshSeconds`

Periodically re-execute the wg utility every this many seconds in order to let WireGuard notice DNS / hostname changes.

Setting this to 0 disables periodic reexecution.

Type: signed integer

Default

0

Example

5

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.peers.*.endpoint`

Endpoint IP or hostname of the peer, followed by a colon, and then a port number of the peer.

Warning for endpoints with changing IPs: The WireGuard kernel side cannot perform DNS resolution. Thus DNS resolution is done once by the wg userspace utility, when setting up WireGuard. Consequently, if the IP address behind the name changes, WireGuard will not notice. This is especially common for dynamic-DNS setups, but also applies to any other DNS-based setup. If you do not use IP endpoints, you likely want to set {option}networking.wireguard.dynamicEndpointRefreshSeconds to refresh the IPs periodically.

Type: null or string

Default

null

Example

"demo.wireguard.io:12913"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.peers.*.name`

Name used to derive peer unit name. Type: string

Default

publicKey

Example

"bernd"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.peers.*.persistentKeepalive`

This is optional and is by default off, because most users will not need it. It represents, in seconds, between 1 and 65535 inclusive, how often to send an authenticated empty packet to the peer, for the purpose of keeping a stateful firewall or NAT mapping valid persistently. For example, if the interface very rarely sends traffic, but it might at anytime receive traffic from a peer, and it is behind NAT, the interface might benefit from having a persistent keepalive interval of 25 seconds; however, most users will not need this. Type: null or signed integer

Default

null

Example

25

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.peers.*.presharedKey`

Base64 preshared key generated by {command}wg genpsk. Optional, and may be omitted. This option adds an additional layer of symmetric-key cryptography to be mixed into the already existing public-key cryptography, for post-quantum resistance.

Warning: Consider using presharedKeyFile instead if you do not want to store the key in the world-readable Nix store.

Type: null or string

Default

null

Example

"rVXs/Ni9tu3oDBLS4hOyAUAa1qTWVA3loR8eL20os3I="

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.peers.*.presharedKeyFile`

File pointing to preshared key as generated by {command}wg genpsk. Optional, and may be omitted. This option adds an additional layer of symmetric-key cryptography to be mixed into the already existing public-key cryptography, for post-quantum resistance.

Type: null or string

Default

null

Example

"/private/wireguard_psk"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.peers.*.publicKey`

The base64 public key of the peer. Type: (optionally newline-terminated) single-line string

Example

"xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg="

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.postSetup`

Commands called at the end of the interface setup. Type: strings concatenated with "\n" or (list of string) convertible to it

Default

""

Example

''printf "nameserver 10.200.100.1" | ${pkgs.openresolv}/bin/resolvconf -a wg0 -m 0''

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.postShutdown`

Commands called after shutting down the interface. Type: strings concatenated with "\n" or (list of string) convertible to it

Default

""

Example

"${pkgs.openresolv}/bin/resolvconf -d wg0"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.preSetup`

Commands called at the start of the interface setup.

Type: strings concatenated with "\n" or (list of string) convertible to it

Default

""

Example

"${pkgs.iproute2}/bin/ip netns add foo"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.preShutdown`

Commands called before shutting down the interface.

Type: strings concatenated with "\n" or (list of string) convertible to it

Default

""

Example

"${pkgs.iproute2}/bin/ip netns del foo"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.privateKey`

Base64 private key generated by {command}wg genkey.

Warning: Consider using privateKeyFile instead if you do not want to store the key in the world-readable Nix store.

Type: null or string

Default

null

Example

"yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk="

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.privateKeyFile`

Private key file as generated by {command}wg genkey.

Type: null or string

Default

null

Example

"/private/wireguard_key"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.socketNamespace`

The pre-existing network namespace in which the WireGuard interface is created, and which retains the socket even if the interface is moved via {option}interfaceNamespace. When null, the interface is created in the init namespace. See documentation.

Type: null or string

Default

null

Example

"container"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix

`networking.wireguard.interfaces.<name>.table`

The kernel routing table to add this interface's associated routes to. Setting this is useful for e.g. policy routing ("ip rule") or virtual routing and forwarding ("ip vrf"). Both numeric table IDs and table names (/etc/rt_tables) can be used. Defaults to "main".

Type: string

Default

"main"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wireguard.nix