Intermediate · Site-to-site VPN with WireGuard on VyOS · section 2 of 6

Keys and peers

✓ Lab-tested 18 October 2026 on VyOS 2026.10.16-0024-rolling

WireGuard identifies each end by a key pair. Each router generates its own private key (which never leaves the router) and a matching public key (which you give to the other side). There are no certificates and no usernames: if a packet decrypts with a peer's key, it came from that peer.

On each router, generate pki wireguard key-pair prints a fresh pair. (The keys in this lesson come from a lab that no longer exists. Never publish a real private key, and in production prefer generate pki wireguard key-pair install interface wg0, which puts the private key straight into the configuration without printing it.)

Each router then gets a wg0 interface:

An address for the tunnel itself: a /30, 10.255.0.1 on R1 and .2 on R2.
A listening UDP port, 51820.
Its own private key.
A peer for the other site: its public key, its public address and port (the endpoint), the addresses allowed through the tunnel from it (AllowedIPs), and a keepalive so that NAT devices along the way keep the tunnel open.

Plus a static route sending the other site's LAN into wg0.

As soon as both ends are committed, the routers complete a handshake. The tunnel is up, and each router can ping the other's tunnel address.

A key pair each (real output, from a lab that no longer exists)

vyos@R1:~$ generate pki wireguard key-pair
Private key: 4D/X9DgG5DxTgUujH2p1/Bt4xx1Cv+puImElA4pY0E4=
Public key: OConCRYmjmBfDgES1tEaOWlemFABGnHdedxblLTPmXo=
vyos@R2:~$ generate pki wireguard key-pair
Private key: YM+hipD0+Vzc1UY2qSuL1zO/OBsdOOOHpDTLxrv5B2c=
Public key: XQamVv310EgscbB6CVqvJHwnfCQXczieqVA5KiWMKjg=

Line 2: Stays on R1.
Line 3: Given to R2.
Line 5: Stays on R2.
Line 6: Given to R1.

R1: the tunnel (with a deliberate mistake)

set interfaces wireguard wg0 address '10.255.0.1/30'
set interfaces wireguard wg0 description 'TUNNEL-TO-SITE-B'
set interfaces wireguard wg0 port '51820'
set interfaces wireguard wg0 private-key '4D/X9DgG5DxTgUujH2p1/Bt4xx1Cv+puImElA4pY0E4='
set interfaces wireguard wg0 peer SITE-B public-key 'XQamVv310EgscbB6CVqvJHwnfCQXczieqVA5KiWMKjg='
set interfaces wireguard wg0 peer SITE-B address '198.51.100.2'
set interfaces wireguard wg0 peer SITE-B port '51820'
set interfaces wireguard wg0 peer SITE-B allowed-ips '10.255.0.0/30'
set interfaces wireguard wg0 peer SITE-B persistent-keepalive '25'
set protocols static route 10.2.0.0/24 interface wg0

Line 1: The tunnel's own addresses.
Line 3: WireGuard's UDP port.
Line 4: R1's private key.
Line 5: R2's public key…
Lines 6–7: …and where to find it.
Line 8: The mistake: only the tunnel subnet is allowed, not site B's LAN.
Line 9: Keeps NAT mappings alive.
Line 10: Send site B's LAN into the tunnel.

R2: the other end, done right

set interfaces wireguard wg0 address '10.255.0.2/30'
set interfaces wireguard wg0 description 'TUNNEL-TO-SITE-A'
set interfaces wireguard wg0 port '51820'
set interfaces wireguard wg0 private-key 'YM+hipD0+Vzc1UY2qSuL1zO/OBsdOOOHpDTLxrv5B2c='
set interfaces wireguard wg0 peer SITE-A public-key 'OConCRYmjmBfDgES1tEaOWlemFABGnHdedxblLTPmXo='
set interfaces wireguard wg0 peer SITE-A address '203.0.113.2'
set interfaces wireguard wg0 peer SITE-A port '51820'
set interfaces wireguard wg0 peer SITE-A allowed-ips '10.255.0.0/30'
set interfaces wireguard wg0 peer SITE-A allowed-ips '10.1.0.0/24'
set interfaces wireguard wg0 peer SITE-A persistent-keepalive '25'
set protocols static route 10.1.0.0/24 interface wg0

Lines 8–9: The tunnel subnet…
Line 9: …and site A's LAN.

The tunnel is up (real output)

vyos@R1:~$ ping 10.255.0.2 count 2
PING 10.255.0.2 (10.255.0.2) 56(84) bytes of data.
64 bytes from 10.255.0.2: icmp_seq=1 ttl=64 time=5.67 ms
64 bytes from 10.255.0.2: icmp_seq=2 ttl=64 time=7.65 ms

--- 10.255.0.2 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1004ms
rtt min/avg/max/mdev = 5.671/6.658/7.645/0.987 ms
vyos@R1:~$ show interfaces wireguard wg0 summary
interface: wg0
  description: TUNNEL-TO-SITE-B
  address: 10.255.0.1/30
  public key: OConCRYmjmBfDgES1tEaOWlemFABGnHdedxblLTPmXo=
  private key: (hidden)
  listening port: 51820

  peer: SITE-B
    public key: XQamVv310EgscbB6CVqvJHwnfCQXczieqVA5KiWMKjg=
    latest handshake: 0:00:15
    status: active
    endpoint: 198.51.100.2:51820
    allowed ips: 10.255.0.0/30
    transfer: 436 bytes received, 1 KB sent
    persistent keepalive: every 25 seconds

Lines 3–4: R2's tunnel address answers.
Line 19: A recent handshake: the keys match.
Line 22: Only the tunnel subnet allowed.
Line 23: Traffic in both directions.