Docs Config WireGuard

WireGuard

Use a WireGuard tunnel as an outbound node — common for relaying through your own WARP/WireGuard setup, or connecting to a corporate internal network.

Simplified Single-Peer Format

When you only have one remote endpoint, you can write server/port/public-key directly at the top level of the node:

config.yaml YAML

proxies:
  - name: "wg"
    type: wireguard
    private-key: eCtXsJZ27+4PbhDkHnB923tkUn2Gj59wZw5wFA75MnU=
    server: 162.159.192.1
    port: 2480
    ip: 172.16.0.2
    ipv6: fd01:5ca1:ab1e:80fa:ab85:6eea:213f:f4a5
    public-key: Cr8hWlKvtDt7nrvf+f0brNQQzabAqrjfBvas9pmowjo=
    allowed-ips: ['0.0.0.0/0']
    udp: true

Full Multi-Peer Format

To connect to multiple remote endpoints, switch to a peers list instead. In this case, the top-level server/port/public-key/pre-shared-key/reserved fields are ignored (private-key still stays at the top level), and each peer's allowed-ips must not overlap.

config.yaml YAML

proxies:
  - name: "wg"
    type: wireguard
    ip: 172.16.0.2
    ipv6: fd01:5ca1:ab1e:80fa:ab85:6eea:213f:f4a5
    private-key: eCtXsJZ27+4PbhDkHnB923tkUn2Gj59wZw5wFA75MnU=
    peers:
      - server: 162.159.192.1
        port: 2480
        public-key: Cr8hWlKvtDt7nrvf+f0brNQQzabAqrjfBvas9pmowjo=
        allowed-ips: ['0.0.0.0/0']
    udp: true

Field Reference

private-keyRequired

The local WireGuard client's private key — you can generate a usable key pair with wg genkey | tee privatekey | wg pubkey > publickey.

ip / ipv6Optional

This machine's address within the WireGuard virtual network; if you don't have an IPv6 address, just remove this line.

allowed-ipsOptional

The routing range at the WireGuard level — since traffic splitting is already handled by Clash, you can generally just set this to ['0.0.0.0/0'].

pre-shared-key / reservedOptional

The pre-shared key and reserved bytes, as required by your provider; reserved also accepts a string format like "U4An".

mtu / persistent-keepaliveOptional

Adjust the MTU size and keepalive interval as needed — usually no need to change these.

Also supports the amnezia-wg-option family of parameters (jc/jmin/jmax, etc.) for obfuscating WireGuard traffic against censorship. This is advanced usage — don't change the defaults unless you need to.