An annotated example (placeholder keys, not real ones)
Below is a typical client config of the kind a VPN provider or a GL.iNet WireGuard server gives you. The keys are placeholders, and the addresses come from private and documentation ranges. A real file contains a real private key, so never paste one into a forum post or a support chat.
[Interface] / PrivateKey = YOUR_PRIVATE_KEY / Address = 10.64.0.2/32 / DNS = 10.64.0.1 / MTU = 1420 / [Peer] / PublicKey = SERVER_PUBLIC_KEY / AllowedIPs = 0.0.0.0/0, ::/0 / Endpoint = vpn.example.net:51820 / PersistentKeepalive = 25
The slashes stand for line breaks. The table explains each line and which tool reads it. The core wg tool reads only some keys. Others are extras that wg-quick and most router and app importers understand. [1][2]
| Line | Section | What it does | Read by |
|---|---|---|---|
| PrivateKey | Interface | Your secret key, made with wg genkey. Required [1] | wg and wg-quick |
| ListenPort (not shown) | Interface | UDP port to listen on; chosen at random if left out, which is normal for clients [1] | wg and wg-quick |
| Address | Interface | The IP address or addresses given to your tunnel interface [2] | wg-quick and importers |
| DNS | Interface | DNS servers to use while the tunnel is up [2] | wg-quick and importers |
| MTU | Interface | Packet size limit; if left out, worked out from the endpoint or default route [2] | wg-quick and importers |
| PublicKey | Peer | The other end's public key, derived from its private key with wg pubkey. Required [1] | wg and wg-quick |
| PresharedKey (optional) | Peer | An extra symmetric key, made with wg genpsk, that adds a post-quantum layer [1] | wg and wg-quick |
| AllowedIPs | Peer | Which destinations go to this peer, and which source addresses are accepted from it [1][3] | wg and wg-quick |
| Endpoint | Peer | The peer's address and port; updated automatically from authenticated packets [1] | wg and wg-quick |
| PersistentKeepalive | Peer | Seconds between empty packets that keep a NAT mapping open; off by default [1] | wg and wg-quick |
The Interface section: who you are
The private key is your identity. You generate it locally with wg genkey and derive the public half with wg pubkey. The quick start shows the one-line version: wg genkey | tee privatekey | wg pubkey > publickey. [4] Only the public key ever leaves your device. If you suspect a private key has leaked, generate a new config. Editing the old one does not help, because the leaked key is still valid.
Address, DNS and MTU are not part of the core protocol settings. The wg-quick manual lists them as extras it handles on top of wg. If MTU is missing, wg-quick picks one from the endpoint addresses or the default route. [2] GL.iNet routers add a layer: the MTU you set on the tunnel in the VPN Dashboard overrides whatever is in the file. [5] GL.iNet's advice for mobile carriers that limit packet size is to lower the default of 1420 to 1380 or 1280. [6]
AllowedIPs: the line that decides routing
WireGuard calls its central idea cryptokey routing. Each peer's public key is tied to a list of tunnel addresses. When you send a packet, AllowedIPs works as a routing table and decides which peer gets it. When a packet arrives, AllowedIPs works as an access control list and decides whether to accept it. [3] So one line controls both what you route into the tunnel and what you trust coming out of it.
0.0.0.0/0 matches every IPv4 address and ::/0 matches every IPv6 address. [1] With those two values, everything goes through the tunnel. wg-quick adds routes for each AllowedIPs entry. When the entry is a default route, it handles it with ip-rule policy routing instead of a plain route. [2] Narrow AllowedIPs to specific ranges and you get split routing: only those destinations use the tunnel, and everything else goes out the normal way.
| Goal | AllowedIPs value | Result |
|---|---|---|
| Everything through a commercial VPN | 0.0.0.0/0, ::/0 | All IPv4 and IPv6 traffic uses the tunnel |
| Everything except IPv6 | 0.0.0.0/0 | IPv6 is not routed to this peer. GL.iNet's notes for some providers, such as OVPN and StarVPN, say to remove IPv6 addresses from the file [7] |
| Reach only your home network | Your home LAN, for example 192.168.50.0/24, plus the server's tunnel address | Home devices through the tunnel; browsing stays local |
| Server side, one client | The client's tunnel address as a /32 | The server accepts only that address from that client [3] |
Provider config versus home-server config
The file format is the same. The differences come from who created it and what they assumed about your network.
| Aspect | Proton VPN config | Home server on a GL.iNet router | NordVPN |
|---|---|---|---|
| Where it comes from | account.protonvpn.com, Downloads, WireGuard configuration: name it, choose platform, options and server, then download a .conf [8] | WireGuard Server, Profiles, Add; each profile gives a QR code, text and a .conf file [9] | GL.iNet lists NordVPN as a built-in WireGuard provider, set up with an access token from your Nord account rather than an imported file [10]. NordVPN's own GL.iNet guide uses OpenVPN files [11] |
| Endpoint | A Proton server you picked, or the recommended one [8] | Your home's public address or DDNS name; port forwarding needed if the GL.iNet router sits behind another router [9] | Not documented in the pages we read |
| Options baked in | NetShield level, Moderate NAT and VPN Accelerator; Free plans get only VPN Accelerator [8] | Remote access to the LAN, client-to-client, IP masquerading and MTU, set on the server [9] | Not documented in the pages we read |
| Multiple tunnels | Each extra tunnel raises the second number in Address and DNS by one, such as 10.4.0.2/32 and 10.4.0.1 [8] | One profile per device | Not applicable |
PersistentKeepalive and NAT
WireGuard is quiet when you are not sending anything. That is efficient, but a NAT router or firewall between the peers may forget the connection after a while. The peer behind it then becomes unreachable until it sends something. PersistentKeepalive sends an empty authenticated packet at a set interval to keep that mapping open. [1] The quick start suggests 25 seconds as an interval that works with a wide range of firewalls. Setting 0 turns it off, which is the default. [4]
For a travel router dialling out to a commercial VPN, keepalive rarely matters, because your own traffic keeps the path open. It matters when something needs to reach the travel router while it sits behind hotel NAT. A common case is a home server that should be able to reach devices behind the travel router. The wg manual says most users do not need keepalive. [1] Add it when you have that kind of inbound need, not by habit.
The edits travelers actually make
Work through this list before editing a config by hand. Keep an untouched copy of the original file.
- Pages stall while the tunnel is up: lower the MTU on the router's tunnel options to 1380, then 1280. [6]
- The router refuses the file or IPv6 errors appear: remove the IPv6 addresses from the file, as GL.iNet's notes for OVPN and StarVPN advise. [7] If you take IPv6 out of Address, take ::/0 out of AllowedIPs as well.
- You want only home devices through the tunnel: replace 0.0.0.0/0 with your home LAN range plus the server's tunnel address.
- Home and travel router both use the same LAN range: change one before connecting them. GL.iNet's server guide gives the example of moving the tunnel subnet to 10.1.0.1/24 when it clashes with an upstream gateway. [9]
- The other end cannot reach you behind hotel NAT: add PersistentKeepalive = 25. [4]
- You changed servers at a provider: download a new file rather than editing the Endpoint. Each server is a separate peer with its own public key. [3]
- A key may have leaked: delete the config at the provider or remove the profile on your server, then generate a new one.
Questions before you decide
What does AllowedIPs = 0.0.0.0/0 mean in WireGuard?
It matches every IPv4 address, so all IPv4 traffic is sent to that peer and any IPv4 source address is accepted from it. Adding ::/0 does the same for IPv6. Narrower ranges give split routing.
Do I need PersistentKeepalive?
Usually not. It is off by default and the wg manual says most users do not need it. Use it, often at 25 seconds, when a peer behind NAT must stay reachable for incoming connections.
Why are Address and DNS not in the wg manual?
They are wg-quick extras, along with MTU, Table and the Up and Down hooks. Most router and app importers understand them, but the core wg tool does not.
Can I reuse one Proton WireGuard config on several devices?
Proton's guide shows separate configs for multiple tunnels, each with its own Address and DNS numbers. Generate one config per device or router so you can revoke one without affecting the others.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- wireguard-tools: wg(8) manual page Accessed 30 Oct 2026
- wireguard-tools: wg-quick(8) manual page Accessed 30 Oct 2026
- WireGuard: Conceptual overview and cryptokey routing Accessed 30 Oct 2026
- WireGuard: Quick Start Accessed 30 Oct 2026
- GL.iNet Router Docs 4: VPN Dashboard (firmware v4.9 and later) Accessed 30 Oct 2026
- GL.iNet Router Docs 4: Why is my VPN speed slow Accessed 30 Oct 2026
- GL.iNet Router Docs 4: Get configuration files from WireGuard service providers Accessed 30 Oct 2026
- Proton VPN Support: How to download WireGuard configuration files Accessed 30 Oct 2026
- GL.iNet Router Docs 4: WireGuard Server Accessed 30 Oct 2026
- GL.iNet Router Docs 4: WireGuard Client Accessed 30 Oct 2026
- NordVPN Help Center: GL.iNet setup with NordVPN Accessed 30 Oct 2026
- GL.iNet Router Docs 4: How to set up VPN obfuscation Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.