vpn peer generate client
Creates a VPN and generates a configuration suitable for import into a WireGuard VPN client.
Syntax
Syntax Description
id
The VPN identifier. Must be a number in the range 0-1022 or the string "auto".
local-only
(Optional) If specified, only local routes on the Island are included in the client configuration file; otherwise, a default route is included.
name
(Optional) A descriptive name for the VPN.
key
(Optional) If specified, the VPN is created using the specified public key for the remote host; otherwise, a public/private key pair is generated.
Defaults
By default, the generated client configuration contains a default route through the VPN, and a public/private key pair is generated for the client.
Usage Guidelines
This command is used to create a VPN on the Island, and to generatate an associated configuration suitable for import directly into a WireGuard client. The generated configuration is displayed in the CLI where it can be copied and pasted into the WireGuard client, or pasted into a file that can be imported into the client.
The VPN ID must be a number between 0 and 1022 that does not already exist on the Island, or the string "auto", which will automatically assign the next available VPN ID.
By default, the command will generate a public/private key pair for the client to use, and will include the private key in the "[Interface]" section of the client configuration. This makes client VPN configuration very easy since the generated configuration can be loaded into the client, and no other steps are necessary. However, because the configuration contains the private key for the client, the configuration should be kept secure, and should be permanently deleted as soon as it has been loaded into the client.
Alternately, the public/private key pair can first be configured on the client, and the resulting public key included in the vpn peer generate client command using the public-key option. This requires extra steps to configure the VPN, but is more secure because the private key does not have to be communcated to the client.
By default, a default IPv4 and a default IPv6 route is specified in the "AllowedIPs" directive in the "[Peer]" section of the generated client configuration, so that all Internet traffic will be routed through the Island. If the local-only option is specified, only routes for local interfaces on the Island will be included in the client configuration.
The name parameter is optional, but is useful to identify the client associated with the VPN.
If a DDNS name has been set on the Island using the ip ddns name command, the DDNS name will be used in the "EndPoint" directive in the "[Peer]" section of the client configuration. A DDNS name is recommended in most cases because it islolates the client from changes in the Island's public IP address. If no DDNS name has been configured, the IP address of the highest priority WAN interface will be used instead. Likewise, the UDP port number in for the endpoint will be set to the value configured with the vpn port command, or to the default port if a custom port number has not been configured.
Examples
Related Commands
Last updated