DEV Community

ricco020
ricco020

Posted on

You don't need to restart WireGuard to add a peer

#wireguard #linux #networking #vpn

Most guides answer "how do I add a WireGuard peer" with this:

wg-quick down wg0 && wg-quick up wg0
Enter fullscreen mode Exit fullscreen mode

That works. It also tears down every active tunnel on the box to add one line to a file. On a server anyone actually depends on, that is the reason people batch peer additions for weeks instead of doing them when asked.

There is a command that does it live.

wg set 

wg set wg0 peer <CLIENT_PUBLIC_KEY> allowed-ips 10.0.0.5/32
Enter fullscreen mode Exit fullscreen mode

The peer exists from that instant. Existing sessions are untouched — wg set edits the running interface through the kernel module rather than rebuilding it.

Nothing is printed on success, which throws people. wg show wg0 is what confirms it.

The catch nobody mentions

wg set changes the running state, not /etc/wireguard/wg0.conf. Reboot and your peer is gone.

You can write the live state back:

wg showconf wg0 > /etc/wireguard/wg0.conf
chmod 600 /etc/wireguard/wg0.conf
Enter fullscreen mode Exit fullscreen mode

But note what showconf actually prints: the interface's private key, along with everything else. If your umask leaves that file world-readable, you have just published it to every account on the machine. The chmod is not optional politeness.

Reloading an edited file without dropping anyone 

wg syncconf wg0 <(wg-quick strip wg0)
Enter fullscreen mode Exit fullscreen mode

syncconf applies the difference. wg-quick down/up rebuilds from scratch — the thing you were trying to avoid in the first place.

The failure that looks like magic

Two peers sharing an AllowedIPs address is the bug that wastes an afternoon, because the symptom is backwards: you add a new client, and the older one stops working. AllowedIPs is what decides which peer a packet belongs to, so a duplicate makes that decision ambiguous.

One /32 per client, never overlapping.

I wrote a small tool that reads a folder of client configs and flags exactly that — duplicate addresses, reused private keys, and AllowedIPs ranges wide enough to swallow the local network: wg-clients-audit. Deliberately silent on 0.0.0.0/0, since full-tunnel is a choice, not a mistake.

The longer version, with the client-side config and the three reasons a new peer fails to connect, is here: WireGuard add peer without restarting the tunnel.

Top comments (0)