WireGuard Configuration
WireGuard configuration
Section titled “WireGuard configuration”show wireguard status id
Section titled “show wireguard status id”[Command]
show wireguard status id
[Purpose]
Display wireguard status
[View]
System view
[Use Cases]
sonic# show wireguard status 1interface: Wg1 Public Key: YvzvpPNpUu9hKC1yxh2OOpSQM1hF6NOt0GAYXSaJdmo= private key: (hidden) listening port: 51820
peer: Ey1F+q49I6hPXGBoqryuATqgCyg2cNJWPFzi3jYfnjY= endpoint: 20.0.0.153:51820->30.0.0.100:51820 allowed ips: 10.0.0.0/24,90.0.0.0/24show wireguard config id
Section titled “show wireguard config id”[Command]
show wireguard config id
[Purpose]
Display wireguard configuration
[View]
System view
[Use Cases]
sonic# show wireguard config 1 ip4 listen_port 51820 private_key UFnTg/3VsDmc6QGimqiSL66FZcBnV/4UiSOcot+gkGw= intf_addr 10.0.0.1/24 peer ip4 public_key YZKmpdlJN+lFlsVFxy9zKdHsdzN8j5BpWjjEgoKucj8= peer public_key YZKmpdlJN+lFlsVFxy9zKdHsdzN8j5BpWjjEgoKucj8= allowed_ip 0.0.0.0/0genkey
Section titled “genkey”[Command]
genkey
[Purpose]
Generate WireGuard keys
[View]
Wireguard configuration view
[Use Cases]
sonic(config-wireguard-1)# genkey Private Key: UFnTg/3VsDmc6QGimqiSL66FZcBnV/4UiSOcot+gkGw= Public Key: YZKmpdlJN+lFlsVFxy9zKdHsdzN8j5BpWjjEgoKucj8=ip4 listen_port port private_key string intf_addr A.B.C.D/M
Section titled “ip4 listen_port port private_key string intf_addr A.B.C.D/M”[Command]
ip4 listen_port port private_key string intf_addr A.B.C.D/M
no ip4
[Purpose]
Configure WireGuard’s listening port, private key, and IPv4 address.
[View]
Wireguard configuration view
[Parameter]
| Parameter | Description |
|---|---|
| listen_port | wireguard listening port |
| private_key | Local private key |
| inft_addr | IPv4 address of the WireGuard tunnel |
[Use Cases]
sonic(config-wireguard-1)# ip4 listen_port 51820 private_key UFnTg/3VsDmc6QGimqiSL66FZcBnV/4UiSOcot+gkGw= intf_addr 10.0.0.1/24ip6 listen_port port private_key string intf_addr A::B/M
Section titled “ip6 listen_port port private_key string intf_addr A::B/M”[Command]
ip6 listen_port port private_key string intf_addr A::B/M
no ip6
[Purpose]
ip6 listen_port port private_key string intf_addr A::B/M
[View]
Wireguard configuration view
[Parameter]
| Parameter | Description |
|---|---|
| listen_port | wireguard listening port |
| private_key | Local private key |
| inft_addr | IPv6 address of the WireGuard tunnel |
[Use Cases]
sonic(config-wireguard-1)# ip6 listen_port 51820 private_key UFnTg/3VsDmc6QGimqiSL66FZcBnV/4UiSOcot+gkGw= intf_addr 2000::1/64mtu value
Section titled “mtu value”[Command]
mtu value
[Purpose]
Configuring the MTU for the WireGuard tunnel
[View]
Wireguard configuration view
[Use Cases]
sonic(config-wireguard-1)# mtu 1000nat-zone id
Section titled “nat-zone id”[Command]
nat-zone id
no nat-zone
[Purpose]
Configuring NAT traversal for WireGuard tunnels
[View]
Wireguard configuration view
[Parameter]
| Parameter | Description |
|---|---|
| nat-zone | The default value is 0, meaning NAT functionality is disabled. When configured as 1 to 3, NAT conversion functionality is enabled. |
[Use Cases]
sonic(config-wireguard-1)# nat-zone 1peer {ip4|ip6} public_key key [endpoint_ip A.B.C.D endpoint_port port] [persistent_keepalive int]
Section titled “peer {ip4|ip6} public_key key [endpoint_ip A.B.C.D endpoint_port port] [persistent_keepalive int]”[Command]
peer {ip4|ip6} public_key key [endpoint_ip A.B.C.D endpoint_port port ] [persistent_keepalive int ]
no peer {ip4|ip6} public_key key
[Purpose]
Configure the WireGuard peer’s public key and IP settings. When the endpoint_ip is not configured, it will passively receive peer requests and learn the peer’s IP and port.
[View]
Wireguard configuration view
[Parameter]
| Parameter | Description |
|---|---|
| public_key | The public key of the remote end |
| endpoint_ip | The ip address of the remote end |
| endpint_port | The port of the remote end |
| persistent_keepalive | Tunnel survival time |
[Use Cases]
sonic(config-wireguard-1)# peer ip4 public_key YZKmpdlJN+lFlsVFxy9zKdHsdzN8j5BpWjjEgoKucj8= endpoint_ip 1.1.1.1 endpoint_port 51820 persistent_keepalive 300peer public_key
Section titled “peer public_key”[Command]
peer public_key key allowed_ip A.B.C.D/M
[Purpose]
Configure the WireGuard peer’s public key and allowed IP list
[View]
Wireguard configuration view
[Parameter]
| Parameter | Description |
|---|---|
| public_key | The public key of the remote end |
| allowed_ip | Allowed IP list for encryption and decryption |
[Use Cases]
sonic(config-wireguard-1)# peer public_key YZKmpdlJN+lFlsVFxy9zKdHsdzN8j5BpWjjEgoKucj8= allowed_ip 10.0.0.0/24,20.0.0.0/24