Setting up WireGuard takes a few minutes on any platform because the whole configuration is about ten lines, and on a phone it is a QR code. The official apps exist for Windows, macOS, iOS, Android and Linux, and most routers that can run a VPN client support it. This guide explains what each line means, walks through every platform, and ends with the handful of things that go wrong. If you want to know how WireGuard compares to other protocols first, that is in WireGuard vs OpenVPN.

The configuration, line by line

``` [Interface] PrivateKey = your device's private key Address = 10.0.0.2/32 DNS = 10.0.0.1

[Peer] PublicKey = the server's public key Endpoint = server address:51820 AllowedIPs = 0.0.0.0/0, ::/0 PersistentKeepalive = 25 ```

  • PrivateKey: your key, never leaves the device; leaking it equals leaking the account.
  • Address: your device's address inside the tunnel.
  • DNS: the resolver used once the tunnel is up. It must be inside the tunnel, otherwise site names go to your ISP.
  • PublicKey: the server's key, used to verify you are talking to the right server.
  • Endpoint: the server's address and port.
  • AllowedIPs: which destinations go through the tunnel; 0.0.0.0/0, ::/0 means everything, IPv4 and IPv6.
  • PersistentKeepalive: a small packet every 25 seconds to keep the connection alive behind mobile carrier NAT.

Your provider gives you this file or a QR code ready to use; you do not need to edit it.

Windows

  1. Download the client from wireguard.com.
  2. Import Tunnel and select the .conf file, or Add Empty Tunnel and paste the configuration.
  3. Activate. If "Latest handshake" shows a time, the tunnel is up.
  4. Confirm at What Is My IP.

Two gotchas. The client enables "Block untunneled traffic" by default, which cuts the internet when the tunnel drops; that is correct behavior, not a fault. And if the server does not support IPv6 but the config includes ::/0, IPv6-only sites will not open; remove ::/0.

macOS

Install from the App Store or wireguard.com, then Import Tunnel from File or paste the configuration. Activate from the menu bar icon. Check the address the same way.

iPhone and iPad

  1. Install the WireGuard app from the App Store, or your provider's app with WireGuard built in.
  2. Tap +, then Create from QR code and scan, or Create from file.
  3. Allow the VPN configuration when iOS asks.
  4. Optionally enable On-Demand Activation in the tunnel's settings so it connects automatically on Wi-Fi or on specific networks.

Android

  1. Install WireGuard from Google Play.
  2. +, then scan the QR code or import the file.
  3. Allow the connection request.
  4. In system settings, enable Always-on VPN and Block connections without VPN for the WireGuard app, and set its battery usage to Unrestricted. Why those matter is in how to set up a VPN on Android.
  5. If the connection drops on mobile data, confirm PersistentKeepalive = 25 is in the config.

A router running OpenWrt

For TVs and consoles that cannot run an app.

  1. opkg update && opkg install wireguard-tools luci-proto-wireguard.
  2. Network → Interfaces → Add new, protocol WireGuard VPN, enter the private key and Address.
  3. On the Peers tab add the server's public key, Endpoint, AllowedIPs and keepalive; tick Route Allowed IPs.
  4. Firewall: put the new interface in the wan zone (or its own), allow lan → that zone, enable masquerading.
  5. DNS: in DHCP/DNS settings, set the upstream resolver to the address inside the tunnel, or every device leaks DNS.
  6. Restart the network and confirm from a device on the LAN at What Is My IP.

Router CPU sets the ceiling: entry-level hardware manages tens to a couple of hundred megabits, gigabit needs x86 or a fast ARM board. The wider trade-offs are in VPN on router vs on each device.

When to use VLESS instead

WireGuard runs over UDP with a recognizable pattern. On networks that block UDP or throttle VPNs (offices, campuses, some hotels, some countries) it fails where VLESS with Reality, which looks like ordinary HTTPS, keeps working. On normal home and mobile networks WireGuard is faster and lighter. An app that switches automatically spares you the decision.

Troubleshooting

  • No handshake: wrong address or port, wrong public key, or the device's clock is off. Enable automatic time.
  • Handshake but no browsing: AllowedIPs does not include the destination, DNS is outside the tunnel, or IPv6 mismatch with the server.
  • Drops after minutes on a phone: no keepalive, or the system froze the app in the background.
  • Only a few megabits: distant server, or the router's CPU is at its limit.
  • Works on mobile data, not on Wi-Fi: the network blocks UDP; use VLESS on that network. Causes in VPN not working on Wi-Fi.

404 VPN includes WireGuard and VLESS with Reality in one app with automatic selection, DNS inside the tunnel and a kill switch, and provides WireGuard configurations for routers. How the connection works is on the how it works page; get started here.