Hub + peer config in minutes // burghardt/easy-wg-quick
Kernel module + wg CLI on your hub server
WireGuard must be installed on the hub. Choose your OS below. Peers (clients) also need WireGuard installed — Android & iOS apps are available on their respective stores.
sudo apt update && sudo apt install -y wireguard wireguard-tools qrencode
sudo dnf install -y wireguard-tools qrencode # Kernel module included since Linux 5.6+
pkg install wireguard py38-qrencode kldload if_wg # Add if_wg_load="YES" to /boot/loader.conf for persistence
sudo pacman -S wireguard-tools qrencode
Grab the script, make it executable
wget https://raw.githubusercontent.com/burghardt/easy-wg-quick/master/easy-wg-quick chmod +x easy-wg-quick
Set your requirements before generating the Hub
The easy-wg-quick script uses multiple .txt files to configure settings. Edit them beforehand to customize your VPN setup.
If you are behind a reverse proxy/NAT, you MUST set extnetip.txt to the LOCAL ADDRESS of your WireGuard server (e.g. 192.168.1.50), not the public IP.
| File | Purpose | Default |
|---|---|---|
extnetif.txt | External interface name | Auto-detected |
extnetip.txt | External IP of hub | Auto-detected |
intnetaddress.txt | Internal IPv4 network prefix | Random 10.x.x. |
intnetmask.txt | Internal IPv4 subnet mask | /24 |
intnetdns.txt | IPv4 DNS for clients | 1.1.1.1 |
intnetmtu.txt | Interface MTU size (1280-1420) | 1280 |
intnetallowedips.txt | Client traffic routing | 0.0.0.0/0, ::/0 |
portno.txt | WireGuard listening port | Random 1025-65535 |
| File | Purpose | Default |
|---|---|---|
forceipv6.txt | Force IPv6 enablement | Not created |
ipv6mode.txt | IPv6 routing mode (NAT vs NDP) | masquerade |
intnet6address.txt | Internal IPv6 prefix | Random fd**:: |
intnet6mask.txt | Internal IPv6 subnet mask | /64 |
intnet6dns.txt | IPv6 DNS for clients | 2606:4700:4700::1111 |
| File | Purpose | Default |
|---|---|---|
fwtype.txt | Firewall backend | OS-dependent |
sysctltype.txt | IP forwarding control | OS-dependent |
seqno.txt | Client sequence number | 10 |
echo "51820" > portno.txt to set Wireguard on a static port number.
Run the script — zero arguments needed
Just run the script. On first run it creates wghub.conf (your server config) and wgclient_1.conf (first peer). Each subsequent run adds a new peer.
./easy-wg-quick # Files created: # wghub.conf ← hub/server config # wgclient_1.conf ← peer 1 config # wgclient_1.png ← QR code image # # Run again to add more peers: ./easy-wg-quick # → wgclient_2.conf ./easy-wg-quick # → wgclient_3.conf
./easy-wg-quick laptop → creates wgclient_laptop.conf
Bring up the VPN interface on the server
Copy the generated hub config to WireGuard's config directory, then enable and start it with systemd.
# Copy config sudo cp wghub.conf /etc/wireguard/wghub.conf # Enable & start on boot sudo systemctl enable wg-quick@wghub sudo systemctl start wg-quick@wghub # Check status systemctl status wg-quick@wghub
sudo wg-quick up wghub to bring up manually. Down: sudo wg-quick down wghub
QR code for mobile / copy conf for desktop
Each peer gets its own .conf file and a scannable QR code. Use whichever method fits the device.
Display the QR code directly in terminal and scan with the WireGuard app (Android/iOS):
# Display QR in terminal qrencode -t ansiutf8 < wgclient_1.conf # Or display a saved QR image cat wgclient_1.png | display
qrencode -t ansiutf8 < wgclient_N.conf
Copy the peer config to WireGuard on the client machine and bring it up:
# On the peer machine — copy config sudo cp wgclient_1.conf /etc/wireguard/wgclient_1.conf sudo systemctl enable wg-quick@wgclient_1 sudo systemctl start wg-quick@wgclient_1
A UCI fragment is generated alongside each peer config. Append it to your router's network config:
# On the OpenWRT router cat wgclient_1_uci.conf >> /etc/config/network /etc/init.d/network reload
Confirm tunnels are up, add future peers
Check that the hub sees connected peers and monitor traffic with wg show.
sudo wg show # Expected output: # interface: wghub # public key: kbaG3Hx... # listening port: 51820 # # peer: th8qYu0... # endpoint: 10.x.x.x:PORT # allowed ips: 10.127.0.10/32 # latest handshake: X seconds ago # transfer: 12 MiB received, 40 MiB sent # Add more peers anytime: ./easy-wg-quick phone # → wgclient_phone.conf ./easy-wg-quick tablet # → wgclient_tablet.conf # Self-upgrade the script: ./easy-wg-quick --upgrade
portno.txt).