Esta página aún no está traducida al español, así que la mostramos en inglés.

WireGuard Config Generator — Server and Client Configs with QR Codes

Set up a WireGuard VPN in minutes. Enter your server’s address and the devices that will connect, and get the server wg0.conf, one client config per device and a QR code for each phone. Keys are generated in your browser with X25519 and never leave it; choose a full or split tunnel, DNS, IPv6, preshared keys and the NAT rules the server needs.

Actualizado el

Devices

Server

wg0.conf

On the server: sudo cp wg0.conf /etc/wireguard/ && sudo chmod 600 /etc/wireguard/wg0.conf, enable forwarding with sudo sysctl -w net.ipv4.ip_forward=1 (add it to /etc/sysctl.conf), open UDP port 51820, then sudo systemctl enable --now wg-quick@wg0.

Tus datos nunca salen de tu ordenador. Todo se procesa localmente en tu navegador.

Cómo usar: WireGuard Config Generator

  1. Enter the server’s public address (IP or domain), the UDP port and the VPN subnet — the defaults work for most setups.
  2. Choose whether clients send all traffic through the VPN (privacy on public Wi-Fi) or only traffic to your private network (split tunnel).
  3. List your devices with + Add device. Each one gets its own keys, address, config file and QR code.
  4. Copy wg0.conf to the server and start it; import the client configs in the WireGuard app — on phones, just scan the QR code.

How the configs fit together

Every WireGuard peer has a key pair. The server’s wg0.conf holds its own private key and one [Peer] block per device with that device’s public key and VPN address. Each client config holds the client’s private key, the server’s public key and Endpoint, and AllowedIPs — the networks to send through the tunnel: 0.0.0.0/0, ::/0 for everything, or just the VPN subnet for a split tunnel.

SettingWhat it does
PostUp / PostDownNAT (masquerade) rules so clients can reach the internet through the server
PersistentKeepalive = 25Keeps the connection open through home routers and mobile networks
PresharedKeyAn extra symmetric key per peer, which also protects against future quantum attacks on the key exchange
DNSResolver the client uses while connected, so DNS doesn’t leak outside the tunnel

Are the keys safe?

Keys are generated on your device with the X25519 algorithm (checked against the RFC 7748 test vectors) and a cryptographic random number generator. Nothing is sent to our server. Still treat the private keys like passwords: don’t paste configs in chats and delete downloaded files you no longer need.

También se busca como: wireguard configuration generator, wireguard key generator, wg0.conf generator, wireguard qr code, wireguard client config, wireguard server setup, wireguard vpn setup.

Herramientas que combinan con: WireGuard Config Generator

  • Subnet Calculator — Enter an IP with a prefix (10.0.0.0/22) or a subnet mask (192.168.1.10 255.255.255.0) to get the network, broadcast, usable hosts and binary breakdown — and split it into subnets.
  • SSH Key Generator — Create an SSH key pair for GitHub, GitLab, servers or CI deploy keys — Ed25519 by default, in standard OpenSSH format, without installing anything.
  • systemd Service Generator — Run your app as a proper Linux service that starts on boot and restarts when it crashes.
  • Generador de códigos QR — Crea un código QR para un enlace, datos de conexión a una red Wi-Fi, una tarjeta de contacto, un correo electrónico, un número de teléfono o un SMS.

Preguntas frecuentes

How do I set up a WireGuard server?
Install WireGuard (sudo apt install wireguard), copy the generated wg0.conf to /etc/wireguard/, enable IP forwarding, open the UDP port in your firewall and run sudo systemctl enable --now wg-quick@wg0.
How do I connect my phone?
Install the WireGuard app, tap + → Scan from QR code and scan the device’s QR code here. The tunnel is ready to switch on.
Full tunnel or split tunnel?
A full tunnel (0.0.0.0/0) sends all traffic through the VPN — best for privacy on public Wi-Fi. A split tunnel sends only traffic for your private network, so the rest of the internet stays fast and local.
Why can my client connect but not reach the internet?
Usually IP forwarding is off or the NAT rule uses the wrong interface. Check sysctl net.ipv4.ip_forward and that “Server’s internet interface” matches ip route’s default device (often eth0 or ens3).
¿Puedo instalar WireGuard Config Generator como aplicación web y utilizarla sin conexión?
Sí. WireGuard Config Generator es una aplicación web instalable (PWA): se instala desde el navegador, no se descarga desde una tienda de aplicaciones. Haz clic en «Instalar aplicación» en la parte superior de esta página en Chrome o Edge (Windows, macOS, Linux, ChromeOS) o, en Android, utiliza «Compartir» → «Añadir a la pantalla de inicio» en iPhone y iPad, o «Archivo» → «Añadir al Dock» en Safari 17+ en un Mac. A continuación, se abrirá en su propia ventana con su propio icono y, como se ejecuta íntegramente en tu navegador, seguirá funcionando sin conexión. Firefox en el ordenador de sobremesa no permite instalar aplicaciones web. Cómo funciona la instalación.

Herramientas relacionadas