# WireGuard monitoring

To monitor a WireGuard server, complete a real WireGuard handshake against it from outside. TunnelHQ does that with the `Endpoint` and keys in your client config every 1 to 5 minutes by plan, and alerts you in 20 channels when the handshake fails.

[Start Free Trial](https://app.tunnelhq.com/register) [View the API docs](https://docs.tunnelhq.com/api/)

## What makes WireGuard monitoring different

WireGuard is a kernel-level VPN protocol that uses Curve25519 key exchange and ChaCha20-Poly1305 encryption. Unlike TLS-based VPNs, WireGuard has no persistent session. Every packet is authenticated independently using a rotating nonce and the peer's public key. This makes WireGuard *fast*, but it also means a standard HTTP or TCP port check tells you almost nothing useful.

A WireGuard server on UDP/51820 will respond to port probes even when:

-   The server's private key has been replaced but peers haven't been updated
-   The preshared key has expired
-   AllowedIPs routing has been misconfigured
-   The underlying interface is up but the peer is effectively unreachable
-   The server is rate-limiting handshake attempts due to DDoS protection

TunnelHQ performs a real WireGuard handshake using your config's `PrivateKey`, `Endpoint`, and peer `PublicKey`. Only a successful handshake counts as "up".

## How TunnelHQ monitors WireGuard

### 1\. Upload your config

Paste your WireGuard config or upload the `.conf` file. TunnelHQ auto-detects the protocol and parses:

```
[Interface]
PrivateKey = yAnz5TF+...
Address = 10.0.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = xTIBA5rb...
Endpoint = 176.61.144.10:51820
AllowedIPs = 0.0.0.0/0
```

### 2\. Scheduled checks from distributed nodes

Pin a tunnel to several countries (Pro and Business) and TunnelHQ runs the handshake from each. If it fails from one country but succeeds from others, you know it's a regional issue (routing, BGP hijack, local DDoS).

### 3\. Alerts the moment a server is confirmed down

On state change (up to down or down to up), TunnelHQ dispatches alerts within 1 second to every configured channel. TunnelHQ has 20 channels, including:

-   Email. Always included, on every plan
-   Slack. With interactive message blocks and incident threading
-   Telegram. Via bot or channel
-   Discord. With embed formatting
-   Webhook. Raw HTTP POST with JSON payload for custom integrations

### 4\. REST API for automation

Trigger a WireGuard check programmatically and pipe results into your own dashboards or alerting tools:

```
curl -X POST https://app.tunnelhq.com/api/v1/check/public \
  -H "Content-Type: application/json" \
  -d '{
    "protocol": "wireguard",
    "config": "[Interface]\nPrivateKey=...\n..."
  }'
```

The response returns handshake latency, the server's public key echoed back, and any error detail if the check failed.

## What a failed check tells you

A failed check comes with a message that says where to look. On a WireGuard tunnel you will see two most often.

-   **Tunnel unreachable.** The handshake didn't complete. Check that the server is running, that the UDP port in `Endpoint` is reachable, and that the server has this client's public key as a peer.
-   **Tunnel established - Internet is stuck.** The handshake worked, but traffic didn't reach the internet. Check the server's routing and NAT, its DNS, and whether its outbound traffic is blocked.

## Pricing for WireGuard monitoring

All plans include WireGuard monitoring.

| Plan | Tunnels | Check interval | Price |
| --- | --- | --- | --- |
| Free trial | 14 days free on every plan. Your card is charged on day 15, and you can cancel any time before. |
| Starter | 20 | 5 min | $12/mo or $84/yr |
| Pro | 100 | 2 min | $39/mo or $276/yr |
| Business | 500 | 1 min | $99/mo or $756/yr |

[See the full plan comparison](https://tunnelhq.com/pricing/)

[Start Free Trial](https://app.tunnelhq.com/register) [Test a config free](https://tunnelhq.com/test/)

## Read more

-   [WireGuard in the docs](https://docs.tunnelhq.com/protocols/wireguard/)
-   [Why WireGuard port monitoring misses real outages](https://tunnelhq.com/blog/why-wireguard-port-monitoring-fails/)
-   [AmneziaWG monitoring](https://tunnelhq.com/amneziawg-monitoring/)

## WireGuard monitoring questions

### What does TunnelHQ check on a WireGuard server?

A full WireGuard handshake using your PrivateKey, Endpoint, and the peer's PublicKey. A responding UDP port is not enough. If the handshake fails (bad key, expired preshared key, firewall misconfig), TunnelHQ flags it and alerts.

### How often can TunnelHQ check a WireGuard server?

As fast as every minute on the Business plan. Pro runs every 2 minutes, Starter every 5 minutes.

### Does TunnelHQ need my WireGuard private key?

Yes, to perform a real handshake. Configs are encrypted with AES-256-GCM at rest and never shared. For best operational hygiene, generate a dedicated monitoring peer key separate from your production client keys.

### Can I monitor WireGuard servers that aren't exposed to the internet?

If a server is only reachable inside your VPC or corporate network, TunnelHQ's public check nodes can't reach it. We're working on a self-hosted check agent for this use case. Contact sales@tunnelhq.com if it's a priority.

### Does this work with AmneziaWG?

Yes. AmneziaWG is a WireGuard variant with traffic obfuscation. TunnelHQ has separate [AmneziaWG protocol support](https://tunnelhq.com/amneziawg-monitoring/). Just paste the AmneziaWG config and it'll auto-detect.

Source: https://tunnelhq.com/wireguard-monitoring/