mirror of
https://codeberg.org/emmett1/wg-connect
synced 2026-08-16 11:12:04 +08:00
165 lines
3.3 KiB
Groff
165 lines
3.3 KiB
Groff
.TH WG-CONNECT 1 "2026-06-23" "wg-connect 1.1" "User Commands"
|
|
.SH NAME
|
|
wg-connect \- bring a WireGuard tunnel up or down
|
|
.SH SYNOPSIS
|
|
.B wg-connect up
|
|
.I config
|
|
.br
|
|
.B wg-connect down
|
|
.RI [ name ]
|
|
.SH DESCRIPTION
|
|
.B wg-connect
|
|
manages a WireGuard tunnel on systems that lack
|
|
.BR wg-quick (8),
|
|
systemd, or bash - typically BusyBox-based distributions.
|
|
.PP
|
|
The
|
|
.B up
|
|
command parses a WireGuard configuration file, creates the tunnel
|
|
interface, applies keys and peers, assigns the address, installs
|
|
routes, and optionally updates
|
|
.IR /etc/resolv.conf .
|
|
State is saved to
|
|
.I /tmp/wg-connect.<iface>.state
|
|
so that
|
|
.B down
|
|
can cleanly tear everything down.
|
|
.PP
|
|
The
|
|
.B down
|
|
command reverses every action: restores the original DNS configuration,
|
|
removes endpoint-specific routes, deletes the interface, and restores
|
|
the previous default route.
|
|
.SH OPTIONS
|
|
.TP
|
|
.B up
|
|
.I config
|
|
Bring the tunnel up.
|
|
.I config
|
|
is required and is resolved as follows:
|
|
.RS
|
|
.IP \[bu]
|
|
If it contains a
|
|
.BR / ,
|
|
it is used as a file path directly.
|
|
.IP \[bu]
|
|
If it ends in
|
|
.BR .conf ,
|
|
it is tried in the current directory, then in
|
|
.IR /etc/wireguard/ .
|
|
.IP \[bu]
|
|
Otherwise it is treated as a name and looked up as
|
|
.IR /etc/wireguard/ <name> .conf .
|
|
.RE
|
|
.TP
|
|
.B down
|
|
.RI [ name ]
|
|
Tear a tunnel down. If
|
|
.I name
|
|
is given, the state file
|
|
.I /tmp/wg-connect.<name>.state
|
|
is used and the interface
|
|
.I <name>
|
|
is torn down. If omitted, the interface defaults to
|
|
.BR wg0 .
|
|
.RS
|
|
.IP
|
|
If the expected state file is missing but the interface still exists,
|
|
it is cleaned up as a leftover from a failed
|
|
.B up
|
|
attempt.
|
|
.RE
|
|
.SH CONFIGURATION FORMAT
|
|
The configuration file follows standard WireGuard syntax with an
|
|
.B [Interface]
|
|
section and one or more
|
|
.B [Peer]
|
|
sections. The
|
|
.BR wg-quick (8)
|
|
extensions
|
|
.BR Address ,
|
|
.BR DNS ,
|
|
.BR MTU ,
|
|
.BR Table ,
|
|
.BR PreUp ,
|
|
.BR PostUp ,
|
|
.BR PreDown ,
|
|
.BR PostDown ,
|
|
and
|
|
.B SaveConfig
|
|
are tolerated in the file but are handled by
|
|
.B wg-connect
|
|
itself rather than passed to
|
|
.BR "wg setconf" .
|
|
.PP
|
|
.BR Address ,
|
|
.BR DNS ,
|
|
.BR Endpoint ,
|
|
and
|
|
.B AllowedIPs
|
|
are the fields that drive the script's own setup logic. All other
|
|
fields are forwarded to the kernel through
|
|
.BR "wg setconf" .
|
|
.PP
|
|
The interface name is derived from the configuration file's basename
|
|
(minus the
|
|
.I .conf
|
|
extension), matching
|
|
.BR wg-quick (8)
|
|
behaviour.
|
|
.PP
|
|
Multiple
|
|
.B [Peer]
|
|
sections are supported.
|
|
.B AllowedIPs
|
|
values are accumulated across all peers, and an explicit route to each
|
|
.BR Endpoint 's
|
|
IP address is added through the original default gateway before the
|
|
default route is replaced.
|
|
.SH FILES
|
|
.TP
|
|
.I /etc/wireguard/*.conf
|
|
Configuration files, looked up by name.
|
|
.TP
|
|
.I /tmp/wg-connect.<iface>.state
|
|
Runtime state written by
|
|
.B up
|
|
and consumed by
|
|
.BR down .
|
|
.TP
|
|
.I /tmp/resolv.conf.wg.bak
|
|
Backup of
|
|
.I /etc/resolv.conf
|
|
taken before the VPN DNS is installed.
|
|
.TP
|
|
.I /tmp/wg-connect.<pid>.conf
|
|
Temporary filtered configuration passed to
|
|
.BR "wg setconf" .
|
|
.SH EXIT STATUS
|
|
.TP
|
|
0
|
|
Success.
|
|
.TP
|
|
1
|
|
An error occurred (missing arguments, configuration file not found,
|
|
interface already up, state file missing on
|
|
.BR down ,
|
|
or usage error).
|
|
.SH NOTES
|
|
.B wg-connect
|
|
must be run as root. It manipulates network interfaces, the routing
|
|
table, and
|
|
.IR /etc/resolv.conf .
|
|
.PP
|
|
IPv6 addresses in
|
|
.B AllowedIPs
|
|
and
|
|
.B Endpoint
|
|
are silently skipped. BusyBox
|
|
.B ip
|
|
often lacks reliable IPv6 support.
|
|
.SH SEE ALSO
|
|
.BR wg (8),
|
|
.BR wg-quick (8),
|
|
.BR ip (8)
|