Conceptually simple
WireGuard has just a few moving parts. Once these click, the configs make obvious sense.
- Interface — a virtual network adapter (e.g.
wg0). Each device gets one, with its own private key and an IP on the VPN subnet. - Peer — another device this one wants to talk to, identified by its public key.
- Endpoint — the real IP:port of a peer (only needed for peers that should be "always reachable," like a server).
- AllowedIPs — what destination IPs should be routed through the tunnel to a particular peer.
0.0.0.0/0= everything;10.0.0.2/32= just that one IP.
The SSH analogy
WireGuard auth works almost exactly like SSH authorized_keys:
| SSH | WireGuard |
|---|---|
| Generate a key pair | Generate a key pair |
Install public key in authorized_keys | Add public key in a [Peer] block |
| Private key never leaves your machine | Same |
| Connect by hostname | Connect by endpoint (only for the "server" peer) |
If you understood SSH keys (Track 2), you already understand WireGuard's trust model.