Skip to content

WireGuard C2S Configuration

1. Introduction

This manual provides step-by-step instructions on how to use the AXS Guard WireGuard Client Config Generator. The generator simplifies the process of creating client configurations (Client-to-Site) for remote devices connecting to your WireGuard server. This document is intended for system administrators.

image

2. Prerequisites

2.1 Server Side

  • The WireGuard feature must be activated on AXS Guard.
  • A tunnel interface must be configured and enabled.
  • Allow UDP port 51820 on the AXS Guard firewall.

2.2 Client Side

  • Windows / macOS / Linux
  • iOS / Android
  • The WireGuard app must be installed

3. Config Generator

3.1 Before You Begin

The WireGuard Config Generator creates a peer configuration that can either be manually copied as text or imported by scanning a QR code.

Important

  • The Private Key generated by the config generator is not saved by the system for security reasons. Ensure you copy the configuration or capture the QR code before navigating away from the configuration page or clicking on the add client as peer button.
  • To ensure the integrity of your VPN connection, the generated QR code and configuration text must be treated as highly sensitive information. This information contains a unique Private Key, which allows access to your network; therefore, it should never be shared over the Internet, posted in public forums, or sent via unencrypted email. If you need to distribute this configuration to a remote user, use a secure, end-to-end encrypted messaging service or a protected file transfer method to prevent unauthorized access.
  • While WireGuard is designed for simplicity, specific configuration and installation steps may vary by client. It is recommended to consult the online manuals or documentation for your chosen client to ensure a secure and optimized setup.
  • For best practices and hardening guidance, see the Security Recommendations section for WireGuard.

3.2 Generating a Configuration

  1. Log in to AXS Guard.
  2. Navigate to VPN > WireGuard > Peers.

  3. Click on the Generate Client Config button.

    image

  4. Enter the required parameters, as explained in the table below.

  5. Manually copy the generated configuration to a file or capture the QR code. Send either one to the remote user via a secure channel .

  6. Click on the add client as peer button.

    image

Parameter Example Value Description
Interface wg0 - wg0 WireGuard server interface to which this client (peer) will connect. Must match an active tunnel interface on AXS Guard.
Name wg0_0 Logical name for the client peer. Used for identification on the server only.
Description generated peer for interface wg0 Optional human-readable description of the peer. No functional impact.
AXS Guard IP 192.168.100.211:51820 Public IP address and UDP port of the WireGuard server. This becomes the client’s Endpoint value.
Peer internal address 10.0.0.254/32 Tunnel IP address assigned to the client. Must be unique per client (/32).
Persistent Keepalive 25 Sends periodic keepalive packets every 25 seconds. Recommended for clients behind NAT or mobile connections.
Allowed IPs 192.168.250.0/24 Defines which traffic is routed through the VPN. 0.0.0.0/0 enables full-tunnel routing (all traffic via VPN). Use a comma-separated list to add multiple networks, for example: 192.0.2.0/24, 192.168.0.0/16.
DNS 192.168.250.253 DNS server pushed to the client while the tunnel is active. Typically an internal DNS resolver.
Private key KOUdMp4/OFdbZdIpDoVjzMk/q0UBKk+FcSsziNFRbmY= Client private key generated by the system. Not stored on the server and must be saved by the client. Must be treated as highly sensitive .
Text configuration image Import this configuration into your WireGuard client. Not stored on the server and must be treated as highly sensitive .
QR code image QR code containing the client configuration, allowing quick import on supported WireGuard mobile clients. Not stored on the server and must be treated as highly sensitive .

3.3 Routing

After adding the peer, generate the routes and update your configuration.

image

3.4 Firewall Configuration

Allow traffic through the WireGuard tunnel for the allowed IPs:

  1. Navigate to Firewall > Rules > Through.

  2. Add a new rule as shown in the example below:

    image

  3. Navigate to Firewall > Policies > Static.

  4. Create a new policy for WireGuard, e.g. stat-wg.

  5. Assign the rule created in step 2 to the policy and save your configuration.

    image

4. Client-side Example

4.1 Software Download

  1. Go to https://www.wireguard.com/install/.
  2. Select the appropriate client for your OS.
  3. Install the client.

4.2 Windows Configuration

  1. Start the WireGuard app.

  2. Add an empty tunnel.

    image

  3. Copy and paste the generated tunnel configuration, then save your configuration.

    image

4.3 VPN Connection Test

  1. In the WireGuard app, click the Activate button.

  2. Open a command prompt and use the ping command to verify tunnel connectivity.

    image

5. Support

5.1 If you encounter a problem

If you encounter a problem with AXS Guard, follow the steps below:

  1. Check the troubleshooting section of the feature-specific manual.

  2. Check the knowledge base on this site for information about special configurations.

  3. If no solution is available in any of the above sources, contact your AXS Guard vendor.

5.2 Contact Information

(+32) 15-504-400
support@axsguard.com