WireGuard Configuration
Chute supports WireGuard as an outbound proxy protocol. You can either configure WireGuard inline in the [Proxy] section, or define a named [WireGuard] section and reference it.
WireGuard Section
A [WireGuard] section defines a complete WireGuard tunnel configuration that can be referenced by name from a WireGuard proxy policy.
[WireGuard wg0]
private-key = base64_private_key
peer-public-key = base64_peer_public_key
self-ip = 10.0.0.2
self-ip-v6 = fd00::2
preshared-key = base64_preshared_key
server = example.com
port = 51820
wg-mtu = 1420
keepalive = 25
Parameters
| Key | Required | Description |
|---|---|---|
private-key |
Yes | WireGuard private key, base64-encoded |
peer-public-key |
Yes | Peer public key, base64-encoded |
self-ip |
No | Local IPv4 address for the WireGuard interface |
self-ip-v6 |
No | Local IPv6 address for the WireGuard interface |
preshared-key |
No | Pre-shared key for post-quantum resistance |
server |
Yes* | Remote server address (used when the proxy line does not specify one; the proxy line takes precedence) |
port |
Yes* | Remote server port (same precedence as server) |
wg-mtu |
No | MTU for the WireGuard interface (default: 1420). mtu is accepted only inline on a [Proxy] line |
keepalive |
No | Persistent keepalive interval in seconds |
reserved |
No | Reserved bytes for the WireGuard handshake header (e.g. reserved=0,1,2) |
* server and port must be present either in the section or on the referencing [Proxy] line; otherwise the policy is rejected as incomplete.
Usage
Reference the section from a proxy policy:
[Proxy]
WG = wireguard, section-name=wg0
[Proxy Group]
WGGroup = select, WG
[Rule]
IP-CIDR,10.0.0.0/8,WGGroup
FINAL,DIRECT
Multiple [WireGuard] sections can be defined for different tunnels:
[WireGuard us]
private-key = ...
peer-public-key = ...
self-ip = 10.0.1.2
[WireGuard eu]
private-key = ...
peer-public-key = ...
self-ip = 10.0.2.2
Note: WireGuard runs over its own UDP tunnel with a userspace TCP/IP stack. The names (e.g.
wg0) are case-sensitive.