# WireGuard

A WireGuard monitor brings a tunnel up from your client config and confirms that the handshake with the server completes. Every check connects to the `Endpoint` in the config's `[Peer]` section.

:::tip[New to TunnelHQ?]
Start with the [Quick start](/docs/quickstart/).
:::

## Adding a WireGuard monitor

Paste the config into **Add monitor**, or upload it as a `.conf` or `.wg` file. TunnelHQ detects WireGuard and reads the server address from `Endpoint`.

| Field | Required | Details |
| --- | --- | --- |
| Config | Yes | The full `[Interface]` and `[Peer]` config, pasted or uploaded as a `.conf` or `.wg` file. |

The server address read from `Endpoint` appears as **IP Address** in the monitor's settings.

```ini title="wg0.conf"
[Interface]
PrivateKey = <client-private-key>
Address = 10.0.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = <server-public-key>
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0
```

To monitor many WireGuard servers at once, upload their configs in [Import monitors](/docs/import/).

## When a check fails

The two most common failures are **Tunnel unreachable** and **Tunnel established - Internet is stuck**.

- **Tunnel unreachable**: the handshake didn't complete. Check that the server is running, that the UDP port in `Endpoint` is reachable, and that the server has this client's public key as a peer.
- **Tunnel established - Internet is stuck**: the handshake worked, but traffic didn't reach the internet. Check the server's routing and NAT, its DNS, and whether its outbound traffic is blocked.

[What a failed check says](/docs/concepts/monitors/#what-a-failed-check-says) lists every failure message.