I set up wireguard on a few hosts.

• one publicly routable VPS (NixOS)

• two non-routable boxes (Guix and NixOS)

This note goes with Wireguard on Guix as I have a Guix system connecting to a NixOS peer.

Notable elements:

• peers need only the keys of boxes routing to them

• peers will cheerfully forward packets from other peers

It didn't occur to me that NixOS might invoke the wireguard tools and generate keys for me. If I set it up on another Nix box, I'll try it and leave out key settings and see what happens. Instead, I generated them manually:

T282828

chmod T79c0ff600 wg-*-key

sudo mkdir /etc/nixos/wg/

sudo mv wg-*-key /etc/nixos/wg

Also on my NixOS VPS system, I have the following wireguard setup stuff:

T282828

networkingTff7b72.wg-quickTff7b72.Ta5d6ffinterfaces Tff7b72= Tb4b4b4{

Ta5d6ffwg0 Tff7b72= Tb4b4b4{

Ta5d6ffaddress Tff7b72= Tb4b4b4[

Ta5d6ff"Ta5d6ff192.168.42.2/32Ta5d6ff"

Tb4b4b4]Tb4b4b4;

Ta5d6fflistenPort Tff7b72= T79c0ff51820Tb4b4b4;

Ta5d6ffdns Tff7b72= Tb4b4b4[ Ta5d6ff"Ta5d6ff8.8.8.8Ta5d6ff" Tb4b4b4]Tb4b4b4;

Ta5d6ffprivateKeyFile Tff7b72= Ta5d6ff"Ta5d6ff/etc/nixos/wg/wg-priv-keyTa5d6ff"Tb4b4b4;

Ta5d6ffpeers Tff7b72= Tb4b4b4[

Tb4b4b4{ T8b949e# twothirty

Ta5d6ffpublicKey Tff7b72= Ta5d6ff"Ta5d6ffmy-public-key-is-hereTa5d6ff"Tb4b4b4;

Ta5d6ffallowedIPs Tff7b72= Tb4b4b4[

Ta5d6ff"Ta5d6ff192.168.42.4/32Ta5d6ff"

Tb4b4b4]Tb4b4b4;

Tb4b4b4}

Tb4b4b4{ T8b949e# mediaserver

Ta5d6ffpublicKey Tff7b72= Ta5d6ff"Ta5d6ffmedia-server-public-key-hereTa5d6ff"Tb4b4b4;

Ta5d6ffallowedIPs Tff7b72= Tb4b4b4[

Ta5d6ff"Ta5d6ff192.168.42.5/32Ta5d6ff"

Tb4b4b4]Tb4b4b4;

Tb4b4b4}

Tb4b4b4]Tb4b4b4;

Tb4b4b4}Tb4b4b4;

Tb4b4b4}Tb4b4b4;

The Guix system host is T383838#twothrity in the above. The allowed IPs from that host are a T383838/32 because it's only that one IP address that is allowed and will be routed to from the VPS. That system isn't allowed to use any other address.

I also have an entry above for my media server, which is another NixOS system. Now when my Guix system is connected from somewhere else, I can get to my media server where Jellyfin is running.

The configuration for that host was created similarly, generating keys and then copying them into a location and putting the following in the T383838configuration.nix:

T282828

networkingTff7b72.wg-quickTff7b72.Ta5d6ffinterfaces Tff7b72= Tb4b4b4{

Ta5d6ffwg0 Tff7b72= Tb4b4b4{

Ta5d6ffaddress Tff7b72= Tb4b4b4[

Ta5d6ff"Ta5d6ff192.168.42.5/32Ta5d6ff"

Tb4b4b4]Tb4b4b4;

Ta5d6ffprivateKeyFile Tff7b72= Ta5d6ff"Ta5d6ff/etc/nixos/wg/wg-priv-keyTa5d6ff"Tb4b4b4;

Ta5d6ffpostUp Tff7b72= Tb4b4b4[Ta5d6ff"Ta5d6ffwg set wg0 peer b4PzzWUSgfON2c/zoFQcJrlaBB7zIIJqbhIQmKcE2

Hc= persistent-keepalive 25Ta5d6ff"Tb4b4b4]Tb4b4b4;

Ta5d6ffpeers Tff7b72= Tb4b4b4[

Tb4b4b4{

Ta5d6ffpublicKey Tff7b72= Ta5d6ff"Ta5d6ffb4PzzWUSgfON2c/zoFQcJrlaBB7zIIJqbhIQmKcE2Hc=Ta5d6ff"Tb4b4b4;

Ta5d6ffallowedIPs Tff7b72= Tb4b4b4[

Ta5d6ff"Ta5d6ff192.168.42.2/24Ta5d6ff"

Tb4b4b4]Tb4b4b4;

Ta5d6ffendpoint Tff7b72= Ta5d6ff"Ta5d6ffmy-vps-host:51820Ta5d6ff"Tb4b4b4;

Tb4b4b4}

Tb4b4b4]Tb4b4b4;

Tb4b4b4}Tb4b4b4;

Tb4b4b4}Tb4b4b4;

Notable elements:

• media server Wireguard IP is 192.168.42.5

• like the guix system it connects to my-vps-host

• this snippet can be re-used to add new systems

• unlike the other two, it has a T383838postUp

The T383838postUp is so that the system will stay connected more aggressively to the VPS so that when my roaming nodes want access to the media server, the VPS will have a fresh route to it.

Bringing the systems up is pretty straightforward. After a T383838nixos-rebuild switch on both of them, they can ping their Wireguard IP addresses.

If the allowed IPs on the client were changed from T383838192.168.42.2/24 to T3838380.0.0.0/0 then the client would route all of its traffic through the VPS and not just the wireguard subnet.

Tags: nixos, wireguard, index

created: 2026-06-14

(re)generated: 2026-07-17