Installs into .claude/skills of the current project.
Are you the author of Wireguard?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/clawic-wireguard)
---
name: WireGuard
slug: wireguard
version: 1.0.0
description: Configure WireGuard VPN tunnels with secure routing and key management.
homepage: https://clawic.com/skills/wireguard
metadata:
clawdbot:
emoji: π
requires:
bins:
- wg
os:
- linux
- darwin
- win32
displayName: WireGuard
---
## AllowedIPs Traps (Most Common Mistakes)
- `AllowedIPs` means different things on each side β server: what peer CAN send; client: what to ROUTE through tunnel
- `0.0.0.0/0` routes ALL traffic including tunnel endpoint β breaks connectivity, must exclude server's public IP first
- Overlapping AllowedIPs between peers = undefined routing β each IP range must belong to exactly one peer
- Wrong mask silently breaks routing β `/32` for single host, `/24` for subnet, verify carefully
## Connection Failures
- No handshake = wrong public key, firewall blocking UDP, or wrong endpoint β check all three, not just one
- One-way traffic = AllowedIPs misconfigured β packets go out but replies don't route back
- Missing `PersistentKeepalive = 25` breaks NAT traversal β peer behind NAT unreachable after ~2 minutes
- Config file permissions must be 600 β wg-quick silently refuses to start with loose permissions
## DNS Leaks
- Without `DNS =` in client config, DNS queries bypass tunnel β leaks real IP to DNS provider
- Full tunnel (`0.0.0.0/0`) without DNS config = false sense of security β traffic tunneled but DNS exposed
## Routing Setup
- IP forwarding disabled by default on Linux β tunnel works but packets don't route between interfaces
- NAT required for internet access through tunnel β without masquerade, return packets don't find their way
- Firewall must allow UDP on ListenPort β WireGuard is UDP only, no TCP fallback exists
## Key Security
- Private key file permissions matter β world-readable key is compromised, set 600 immediately after generation
- Never transmit private keys β generate on each machine, exchange only public keys
- Config files contain private keys β treat wg0.conf as secret, not just privatekey file
## Live Changes
- Adding peers requires interface reload on most setups β or use `wg set` for live changes without dropping connections
- `wg syncconf` applies changes without restart β but config file format differs from wg.conf (use `wg-quick strip`)
## Debugging
- `wg show` displays handshake timestamps β stale handshake (>2 min) means connection dead despite interface up
- Handshake happens on first packet β no traffic = no handshake attempt, ping to test
