Repository files navigation

This is an implementation of WireGuard in Go.

Most Linux kernel WireGuard users are used to adding an interface withip link add wg0 type wireguard. With wireguard-go, instead simply run:

$ wireguard-go wg0

This will create an interface and fork into the background. To remove the interface, use the usualip link del wg0, or if your system does not support removing interfaces directly, you may instead remove the control socket viarm -f /var/run/wireguard/wg0.sock, which will result in wireguard-go shutting down.

To run wireguard-go without forking to the background, pass-f or--foreground:

$ wireguard-go -f wg0

When an interface is running, you may usewg(8) to configure it, as well as the usualip(8) andifconfig(8) commands.

To run with more logging you may set the environment variableLOG_LEVEL=debug.

This will run on Linux; however you should instead use the kernel module, which is faster and better integrated into the OS. See theinstallation page for instructions.

This runs on macOS using the utun driver. It does not yet support sticky sockets, and won't support fwmarks because of Darwin limitations. Since the utun driver cannot have arbitrary interface names, you must either useutun[0-9]+ for an explicit interface name orutun to have the kernel select one for you. If you chooseutun as the interface name, and the environment variableWG_TUN_NAME_FILE is defined, then the actual name of the interface chosen by the kernel is written to the file specified by that variable.

This runs on Windows, but you should instead use it from the morefully featured Windows app, which uses this as a module.

This will run on FreeBSD. It does not yet support sticky sockets. Fwmark is mapped toSO_USER_COOKIE.

This will run on OpenBSD. It does not yet support sticky sockets. Fwmark is mapped toSO_RTABLE. Since the tun driver cannot have arbitrary interface names, you must either usetun[0-9]+ for an explicit interface name ortun to have the program select one for you. If you choosetun as the interface name, and the environment variableWG_TUN_NAME_FILE is defined, then the actual name of the interface chosen by the kernel is written to the file specified by that variable.

This requires an installation of the latest version ofGo.

$ git clone https://git.zx2c4.com/wireguard-go$ cd wireguard-go$ make

Copyright (C) 2017-2025 WireGuard LLC. All Rights Reserved.Permission is hereby granted, free of charge, to any person obtaining a copy ofthis software and associated documentation files (the "Software"), to deal inthe Software without restriction, including without limitation the rights touse, copy, modify, merge, publish, distribute, sublicense, and/or sell copiesof the Software, and to permit persons to whom the Software is furnished to doso, subject to the following conditions:The above copyright notice and this permission notice shall be included in allcopies or substantial portions of the Software.THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS ORIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THEAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHERLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THESOFTWARE.