WireGuard Configuration

Chute supports WireGuard as an outbound proxy protocol. You can either configure WireGuard inline in the [Proxy] section, or define a named [WireGuard] section and reference it.

WireGuard Section

A [WireGuard] section defines a complete WireGuard tunnel configuration that can be referenced by name from a WireGuard proxy server.

[WireGuard wg0]
private-key = base64_private_key
peer-public-key = base64_peer_public_key
self-ip = 10.0.0.2
self-ip-v6 = fd00::2
preshared-key = base64_preshared_key
server = example.com
port = 51820
wg-mtu = 1420
keepalive = 25

Parameters

* server and port must be present either in the section or on the referencing [Proxy] line; otherwise the policy is rejected as incomplete.

Surge peer Syntax

A section may describe its peer the way Surge does:

[WireGuard wg0]
private-key = base64_private_key
self-ip = 10.0.0.2
mtu = 1280
peer = (public-key = base64_peer_public_key, endpoint = example.com:51820, preshared-key = base64_preshared_key, keepalive = 25, client-id = 1/2/3, allowed-ips = "0.0.0.0/0, ::/0")

• public-key becomes peer-public-key, endpoint (host:port, or [v6]:port) becomes server and port, client-id = a/b/c becomes reserved, and preshared-key and keepalive keep their names. A key written directly in the section wins over the same value inside peer. The current engine parses reserved but does not apply it.
• Only one peer is used; a second one is reported as an advisory and ignored.
• allowed-ips is compiled and enforced for WireGuard TCP and UDP: a destination outside the peer's CIDRs is refused or dropped because that peer cannot route it back. Surge's section keys dns-server and prefer-ipv6 remain preserved but have no effect and appear in the notice about ignored options.
• When the configuration is saved, the section is written back with the keys above instead of the peer = (…) line.

Usage

Reference the section from a proxy server:

[Proxy]
WG = wireguard, section-name=wg0

[Proxy Group]
WGGroup = select, WG

[Rule]
IP-CIDR,10.0.0.0/8,WGGroup
FINAL,DIRECT

Multiple [WireGuard] sections can be defined for different tunnels:

[WireGuard us]
private-key = ...
peer-public-key = ...
self-ip = 10.0.1.2

[WireGuard eu]
private-key = ...
peer-public-key = ...
self-ip = 10.0.2.2

Note: WireGuard runs over its own UDP tunnel with a userspace TCP/IP stack. The names (e.g. wg0) are case-sensitive.

AmneziaWG Section

Chute also supports AmneziaWG, a WireGuard variant with traffic obfuscation. An [AmneziaWG <name>] section accepts the same keys as a [WireGuard] section, plus the following obfuscation parameters:

• jc, jmin, jmax — junk packet count and size range. With jc above zero, jmin and jmax must both be set, and jmax must not be smaller than jmin, or the tunnel is refused.
• s1, s2, s3, s4 — junk prepended to init/response/cookie/transport packets. s1–s3 may not exceed 64 bytes (s4 32), and s1 + 148 must differ from s2 + 92, or the tunnel is refused.
• h1, h2, h3, h4 — custom message-type header values. Each is a decimal number or a start-end range within 32 bits, and must be greater than 4, since 1–4 are WireGuard's own message types; the four may not overlap, or the tunnel is refused.
• i1, i2, i3, i4, i5 — special junk packet definitions. A definition that does not parse refuses the tunnel.

A refused parameter combination is logged as WireGuard: AmneziaWG parameters rejected: <reason>, and the tunnel then fails with Failed to create BoringTun tunnel.

A policy references the section with type amneziawg (alias awg):

[AmneziaWG awg0]
private-key = base64_private_key
peer-public-key = base64_peer_public_key
self-ip = 10.0.0.2
server = example.com
port = 51820
jc = 4
jmin = 40
jmax = 70
s1 = 15
s2 = 60
h1 = 123456
h2 = 67543
h3 = 32345
h4 = 123123

[Proxy]
AWG = amneziawg, section-name=awg0

Cross-validation rules:

• AmneziaWG parameters in a plain [WireGuard] section are a configuration error — use an [AmneziaWG] section instead.
• reserved cannot be used in an [AmneziaWG] section: it writes the same header bytes that h4 replaces, so the combination is rejected as an error.
• An [AmneziaWG] section with no obfuscation parameters gets an advisory — it behaves as plain WireGuard.