WireGuard monitoring

To monitor a WireGuard server, complete a real WireGuard handshake against it from outside. TunnelHQ does that with the Endpoint and keys in your client config every 1 to 5 minutes by plan, and alerts you in 20 channels when the handshake fails.

Start Free Trial View the API docs

What makes WireGuard monitoring different

WireGuard is a kernel-level VPN protocol that uses Curve25519 key exchange and ChaCha20-Poly1305 encryption. Unlike TLS-based VPNs, WireGuard has no persistent session. Every packet is authenticated independently using a rotating nonce and the peer's public key. This makes WireGuard fast, but it also means a standard HTTP or TCP port check tells you almost nothing useful.

A WireGuard server on UDP/51820 will respond to port probes even when:

The server's private key has been replaced but peers haven't been updated
The preshared key has expired
AllowedIPs routing has been misconfigured
The underlying interface is up but the peer is effectively unreachable
The server is rate-limiting handshake attempts due to DDoS protection

TunnelHQ performs a real WireGuard handshake using your config's PrivateKey, Endpoint, and peer PublicKey. Only a successful handshake counts as "up".

How TunnelHQ monitors WireGuard

1. Upload your config

Paste your WireGuard config or upload the .conf file. TunnelHQ auto-detects the protocol and parses:

[Interface]
PrivateKey = yAnz5TF+...
Address = 10.0.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = xTIBA5rb...
Endpoint = 176.61.144.10:51820
AllowedIPs = 0.0.0.0/0

2. Scheduled checks from distributed nodes

Pin a tunnel to several countries (Pro and Business) and TunnelHQ runs the handshake from each. If it fails from one country but succeeds from others, you know it's a regional issue (routing, BGP hijack, local DDoS).

3. Alerts the moment a server is confirmed down

On state change (up to down or down to up), TunnelHQ dispatches alerts within 1 second to every configured channel. TunnelHQ has 20 channels, including:

Email. Always included, on every plan
Slack. With interactive message blocks and incident threading
Telegram. Via bot or channel
Discord. With embed formatting
Webhook. Raw HTTP POST with JSON payload for custom integrations

4. REST API for automation

Trigger a WireGuard check programmatically and pipe results into your own dashboards or alerting tools:

curl -X POST https://app.tunnelhq.com/api/v1/check/public \
  -H "Content-Type: application/json" \
  -d '{
    "protocol": "wireguard",
    "config": "[Interface]\nPrivateKey=...\n..."
  }'

The response returns handshake latency, the server's public key echoed back, and any error detail if the check failed.

What a failed check tells you

A failed check comes with a message that says where to look. On a WireGuard tunnel you will see two most often.

Tunnel unreachable. The handshake didn't complete. Check that the server is running, that the UDP port in Endpoint is reachable, and that the server has this client's public key as a peer.
Tunnel established - Internet is stuck. The handshake worked, but traffic didn't reach the internet. Check the server's routing and NAT, its DNS, and whether its outbound traffic is blocked.

Pricing for WireGuard monitoring

All plans include WireGuard monitoring.

Plan	Tunnels	Check interval	Price
Free trial	14 days free on every plan. Your card is charged on day 15, and you can cancel any time before.
Starter	20	5 min	$12/mo or $84/yr
Pro	100	2 min	$39/mo or $276/yr
Business	500	1 min	$99/mo or $756/yr

See the full plan comparison

Start Free Trial Test a config free

WireGuard monitoring questions

What does TunnelHQ check on a WireGuard server?

A full WireGuard handshake using your PrivateKey, Endpoint, and the peer's PublicKey. A responding UDP port is not enough. If the handshake fails (bad key, expired preshared key, firewall misconfig), TunnelHQ flags it and alerts.

How often can TunnelHQ check a WireGuard server?

As fast as every minute on the Business plan. Pro runs every 2 minutes, Starter every 5 minutes.

Does TunnelHQ need my WireGuard private key?

Yes, to perform a real handshake. Configs are encrypted with AES-256-GCM at rest and never shared. For best operational hygiene, generate a dedicated monitoring peer key separate from your production client keys.

Can I monitor WireGuard servers that aren't exposed to the internet?

If a server is only reachable inside your VPC or corporate network, TunnelHQ's public check nodes can't reach it. We're working on a self-hosted check agent for this use case. Contact [email protected] if it's a priority.

Does this work with AmneziaWG?

Yes. AmneziaWG is a WireGuard variant with traffic obfuscation. TunnelHQ has separate AmneziaWG protocol support. Just paste the AmneziaWG config and it'll auto-detect.