PremiumComes with the add-on reqad-wireguard. Installing add-ons
WireGuard
The WireGuard add-on manages the peers of a WireGuard VPN that runs on the server: add a device by its public key, and Reqad gives it the next free address and shows the client configuration to paste into it.
reqad-wireguard (it installs wireguard-tools too), see installing an add-on. It adds WireGuard to the menu and a tile on the dashboard.Before you start
The add-on manages peers; it does not create the tunnel. The server needs a working WireGuard interface first:
- Its configuration, by default
/etc/wireguard/wg0.conf, with the[Interface]section (address, listen port, private key). - The server's public key in
/etc/wireguard/keys/hub.pub. Reqad reads only the public key, never the private one. - The listen port open in the firewall, and the interface started (
systemctl enable --now wg-quick@wg0).
Settings
| Setting | What it is |
|---|---|
| Endpoint | The public address and port clients connect to, such as 203.0.113.10:51820; without a port, the tunnel's listen port is added. It goes into every client configuration, with PersistentKeepalive = 25. |
| Client AllowedIPs | The networks a client sends through the tunnel. The VPN subnet is always added. |
| Config path | The tunnel's configuration file. Default /etc/wireguard/wg0.conf. |
| Subnet | The /24 network peers get their addresses from. Default 10.10.0.0/24. |
Peers
- The person who uses the device makes a key pair in their WireGuard app and gives you its public key (44 characters).
- Add Peer: paste the key and give the peer a name, such as
anna_laptop. It gets the lowest free address of the subnet (from.2to.254). - View config shows the lines to add to the client's configuration, after its own
[Interface] PrivateKey: its address and a[Peer]section with the server's public key, the endpoint and the allowed IPs.
Disable keeps a peer in the file, commented out, with its address reserved; Enable brings it back. Delete removes it from the tunnel. Every change is written to the configuration file and applied to the running tunnel at once, without dropping the other peers' connections.
The configuration file is the list: there is no separate database. Peers you add by hand, with a # --- Peer: <name> --- comment above their [Peer] section, show on the page like the others.
Need a hand? Create a free account or contact us.