Skip to content
TunnelHQTunnelHQ Docs

WireGuard

Open in ChatGPTOpen in Claude

A WireGuard monitor brings a tunnel up from your client config and confirms that the handshake with the server completes. Every check connects to the Endpoint in the config’s [Peer] section.

Adding a WireGuard monitor

Section titled “Adding a WireGuard monitor”

Paste the config into Add monitor, or upload it as a .conf or .wg file. TunnelHQ detects WireGuard and reads the server address from Endpoint.

Field Required Details
Config Yes The full [Interface] and [Peer] config, pasted or uploaded as a .conf or .wg file.

The server address read from Endpoint appears as IP Address in the monitor’s settings.

wg0.conf
[Interface]
PrivateKey = <client-private-key>
Address = 10.0.0.2/32
DNS = 1.1.1.1


[Peer]
PublicKey = <server-public-key>
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0

To monitor many WireGuard servers at once, upload their configs in Import monitors.

When a check fails

Section titled “When a check fails”

The two most common failures are Tunnel unreachable and Tunnel established - Internet is stuck.

  • Tunnel unreachable: the handshake didn’t complete. Check that the server is running, that the UDP port in Endpoint is reachable, and that the server has this client’s public key as a peer.
  • Tunnel established - Internet is stuck: the handshake worked, but traffic didn’t reach the internet. Check the server’s routing and NAT, its DNS, and whether its outbound traffic is blocked.

What a failed check says lists every failure message.