WireGuard VPN config

The file has two blocks. The Interface block describes your end of the tunnel. PrivateKey is your secret and the only thing in the file that must never be shared: whoever has it is you, as far as the server is concerned. Address is the internal address the tunnel gives you inside the VPN network, usually a single address with a /32 suffix, meaning it is yours alone and not a range you route for.

DNS in the Interface block tells the operating system which resolver to use while the tunnel is up. This is the line that prevents DNS leaks, because without it your device keeps asking your local network resolver and your queries still reveal every hostname you visit even though the traffic itself is encrypted. MTU appears when the path needs a smaller packet size than the default 1420, which is the single most common manual fix on mobile networks and some hotel links.

The Peer block describes the server. PublicKey identifies it and is how your client knows it is talking to the right machine. PresharedKey, when present, adds a symmetric layer on top of the normal handshake; it is optional and mainly a hedge against future attacks on the key exchange. Endpoint is the server address and UDP port your client sends to.

AllowedIPs is the line people misread most often. It is not a firewall rule, it is a routing decision: it lists which destinations go through the tunnel. Set to 0.0.0.0/0 and ::/0 it means everything, which is what you want for a full VPN. Set to a narrower range it becomes split tunnelling, where only those destinations use the VPN. PersistentKeepalive, usually 25, sends a tiny packet every 25 seconds so a router with NAT does not forget the mapping and silently break incoming traffic.

iOS and iPadOS: install the official WireGuard app, choose Add a tunnel and Create from QR code, then scan the QR on your order page. This is much faster than typing keys on a phone. Importing a .conf file also works if you save it to Files first and use Create from file or archive. iOS will ask permission to add a VPN configuration, which is normal and required.

Android: the official WireGuard app has the same two paths, and the QR is the easy one. On a de-Googled phone install the app from F-Droid rather than the Play Store. If you use per-app tunnelling, the app lets you include or exclude specific applications from the tunnel, which is a feature of the client, not of the config file.

Windows: the official WireGuard client imports a .conf with Add Tunnel and the file picker, or by dragging the file onto the window. It does not read QR codes, so download the file. The client installs itself as a service, so the tunnel can be set to start with the machine.

macOS: the WireGuard app from the App Store imports a .conf the same way, and there is also a command line path with wg-quick if you installed WireGuard through Homebrew. The App Store build runs as a system extension and asks for VPN permission the first time.

Linux: put the .conf in /etc/wireguard/ as something like vpn.conf, make it readable only by root, then bring it up with wg-quick up vpn and down with wg-quick down vpn. Enable it at boot with the systemd unit named after the file. GNOME and KDE can also import a .conf through their network settings if you prefer a graphical switch.

A WireGuard client is a list of tunnels, not a single connection, and importing more than one costs nothing. The practical habit that makes the difference: on the day you buy, import three or four servers rather than one. A nearby server for daily use, a second nearby one for when the first is busy, and one in a different region for when you need a different exit country.

Switching is immediate because there is no session to negotiate. WireGuard has no login and no connect phase in the way OpenVPN does: the client sends its first encrypted packet and the tunnel either works within a second or does not. Activating a different tunnel deactivates the current one on every official client.

The reason to do this in advance is that a network you cannot get through is also a network you cannot download configs on. Your order page needs a working connection. Importing everything while things are fine turns a bad network from a problem into a two-second switch.

All servers in the network are on the same account and count against the same five simultaneous connections, so keeping ten tunnels imported and using one costs nothing at all.

A kill switch means traffic stops rather than leaking if the tunnel drops. WireGuard has no such feature in the protocol, and no config file can create one on its own. What exists is a platform feature, and it is different on each platform, so be sceptical of any provider that describes a kill switch as if it were universal.

Windows: the official client has a real one. In the tunnel settings, Block untunneled traffic is available when AllowedIPs is 0.0.0.0/0, and it installs firewall rules that drop anything outside the tunnel. This is the strongest of the built-in options.

Android: the client itself has no kill switch, but Android does. In the system VPN settings, turn on Always-on VPN and Block connections without VPN for the WireGuard app. That is a system-level guarantee and it survives reboots.

iOS: there is no true kill switch. On-demand rules can bring the tunnel back automatically, which covers most real cases, but there is a short window during network changes where traffic can leave outside the tunnel. Anyone claiming an absolute kill switch on stock iOS is overstating it.

macOS and Linux: neither has one built in. On Linux the honest answer is firewall rules, either a nftables or iptables policy that only permits traffic out of the WireGuard interface and to the endpoint address, or wg-quick PostUp and PostDown lines that install and remove those rules with the tunnel. On macOS the practical equivalents are on-demand rules in the app or a third-party firewall.

The symptom is always the same: the tunnel says it is active, the client shows bytes sent but zero or almost zero received, and the last handshake time never updates. WireGuard is quiet by design and gives you no error, so you diagnose it by elimination.

Blocked UDP is the most common cause by a wide margin. WireGuard is UDP only, and hotel, airport, corporate and campus networks often permit only TCP on ports 80 and 443. There is no WireGuard setting that fixes this because the protocol cannot run over TCP. The answer is to switch to OpenVPN over TCP on port 443, which is on the same account and the same order page, and to try VLESS if that is blocked too.

MTU is the second cause and it looks different: the handshake completes and small things work, but pages hang halfway and large downloads stall. That is fragmentation. Lower the MTU line in the Interface block to 1380, and if it still stalls try 1280. Mobile networks and any path with an extra layer of encapsulation are where this shows up.

DNS is the third. If the tunnel is up and an IP address responds but no hostname resolves, the DNS line is missing, or the platform is ignoring it, or a private DNS setting is overriding it. On Android, check that Private DNS in system settings is not forcing a resolver outside the tunnel.

Two smaller ones worth checking before you write in: a device clock that is badly wrong can break the handshake, and a config imported twice under different names but with the same keys can produce confusing behaviour when both tunnels are up. If none of that helps, contact support with the server name and what you see, and if the service does not connect on any server after we have worked through it, it is refunded.

Every server in the network offers a WireGuard config, and the network spans dozens of countries. The same account also carries OpenVPN and VLESS, which is what makes the failure path above workable rather than theoretical: when UDP is blocked you already own the alternative.

Five devices can be connected at once. Bandwidth is not metered, the ports are 1 Gbps, and P2P is allowed rather than quietly throttled. Plans run from 7 to 365 days, priced per plan on /vpn/, and nothing renews automatically. Extending is a second payment on the same order page and the new period is added on top of the current expiry.

Payment is crypto only, including Monero, with no account, no email and no identity check. The network keeps no logs: source IP addresses and connection timestamps are not stored, and servers run from RAM so a reboot wipes the machine. That is a description of what we control, not a claim that a VPN makes anyone untraceable.

One warning that belongs on this page because people hit it: turn the VPN off while installing an eSIM. The eSIM download has to reach the operator directly, and a tunnel in the way is the most common cause of a profile that will not install.