Linux Command: wg

The wg command is the configuration utility for WireGuard, the modern high-performance VPN protocol built into the Linux kernel since version 5.6. It allows you to create and manage WireGuard interfaces, generate cryptographic keys, add and remove peers, and monitor tunnel status. WireGuard is fundamentally different from traditional VPN solutions like OpenVPN and IPsec. With approximately 4,000 lines of kernel code (compared to OpenVPN's 600,000+), WireGuard delivers superior performance, simpler configuration, and a smaller attack surface. It uses state-of-the-art cryptography: Curve25519 for key exchange, ChaCha20 for encryption, Poly1305 for authentication, and BLAKE2s for hashing. The wg command works alongside wg-quick, which provides a higher-level interface for bringing up and down WireGuard interfaces using configuration files. While wg handles low-level interface configuration, wg-quick manages routing, DNS, and firewall rules automatically. System administrators use wg for key generation, real-time tunnel monitoring, dynamic peer management (adding/removing peers without restart), and troubleshooting VPN connectivity issues.

Syntax

wg [SUBCOMMAND] [OPTIONS]

Key Options

• show — Show current WireGuard interface configuration and status
• show wg0 — Show status of specific interface
• showconf wg0 — Show running configuration in config file format
• genkey — Generate a new private key
• pubkey — Derive public key from private key
• genpsk — Generate a preshared key for quantum resistance

Examples

Generate a key pair

wg genkey | tee /etc/wireguard/private.key | wg pubkey > /etc/wireguard/public.key && chmod 600 /etc/wireguard/private.key

Show interface status

sudo wg show wg0

Output: interface: wg0\n public key: abc123...\n private key: (hidden)\n listening port: 51820\n\npeer: def456...\n endpoint: 203.0.113.1:51820\n allowed ips: 10.0.0.2/32\n latest handshake: 42 seconds

Add a peer dynamically

sudo wg set wg0 peer "PEER_PUBLIC_KEY" allowed-ips 10.0.0.10/32 endpoint "vpn.example.com:51820"

Pro Tips

• Private keys should be chmod 600, owned by root. Never share private keys. Only exchange public keys between peers.
• Use wg-quick up/down for starting/stopping tunnels. Use raw wg commands for dynamic peer management and monitoring.
• WireGuard performs a new handshake every 2 minutes. If latest handshake is older than 5 minutes, the peer is likely unreachable.

Learn more: Full wg reference →