WireGuard Configuration
Chute supports WireGuard as an outbound proxy protocol. You can either configure WireGuard inline in the [Proxy] section, or define a named [WireGuard] section and reference it.
WireGuard Section
A [WireGuard] section defines a complete WireGuard tunnel configuration that can be referenced by name from a WireGuard proxy policy.
[WireGuard wg0]
private-key = base64_private_key
peer-public-key = base64_peer_public_key
self-ip = 10.0.0.2
self-ip-v6 = fd00::2
preshared-key = base64_preshared_key
server = example.com
port = 51820
wg-mtu = 1420
keepalive = 25
Parameters
| Key | Required | Description |
|---|---|---|
private-key |
Yes | WireGuard private key, base64-encoded |
peer-public-key |
Yes | Peer public key, base64-encoded |
self-ip |
No | Local IPv4 address for the WireGuard interface |
self-ip-v6 |
No | Local IPv6 address for the WireGuard interface |
preshared-key |
No | Pre-shared key for post-quantum resistance |
server |
Yes* | Remote server address (used when the proxy line does not specify one; the proxy line takes precedence) |
port |
Yes* | Remote server port (same precedence as server) |
wg-mtu |
No | MTU for the WireGuard interface (default: 1420). mtu is accepted only inline on a [Proxy] line |
keepalive |
No | Persistent keepalive interval in seconds |
reserved |
No | Reserved bytes for the WireGuard handshake header (e.g. reserved=0,1,2) |
* server and port must be present either in the section or on the referencing [Proxy] line; otherwise the policy is rejected as incomplete.
Usage
Reference the section from a proxy policy:
[Proxy]
WG = wireguard, section-name=wg0
[Proxy Group]
WGGroup = select, WG
[Rule]
IP-CIDR,10.0.0.0/8,WGGroup
FINAL,DIRECT
Multiple [WireGuard] sections can be defined for different tunnels:
[WireGuard us]
private-key = ...
peer-public-key = ...
self-ip = 10.0.1.2
[WireGuard eu]
private-key = ...
peer-public-key = ...
self-ip = 10.0.2.2
Note: WireGuard runs over its own UDP tunnel with a userspace TCP/IP stack. The names (e.g.
wg0) are case-sensitive.
AmneziaWG Section
Chute also supports AmneziaWG, a WireGuard variant with traffic obfuscation. An [AmneziaWG <name>] section accepts the same keys as a [WireGuard] section, plus the following obfuscation parameters:
jc,jmin,jmax— junk packet count and size ranges1,s2,s3,s4— junk prepended to init/response/cookie/transport packetsh1,h2,h3,h4— custom message-type header valuesi1,i2,i3,i4,i5— special junk packet definitions
A policy references the section with type amneziawg (alias awg):
[AmneziaWG awg0]
private-key = base64_private_key
peer-public-key = base64_peer_public_key
self-ip = 10.0.0.2
server = example.com
port = 51820
jc = 4
jmin = 40
jmax = 70
s1 = 15
s2 = 68
h1 = 123456
h2 = 67543
h3 = 32345
h4 = 123123
[Proxy]
AWG = amneziawg, section-name=awg0
Cross-validation rules:
- AmneziaWG parameters in a plain
[WireGuard]section are a configuration error — use an[AmneziaWG]section instead. reservedcannot be used in an[AmneziaWG]section: it writes the same header bytes thath4replaces, so the combination is rejected as an error.- An
[AmneziaWG]section with no obfuscation parameters gets an advisory — it behaves as plain WireGuard.