Reloading WireGuard Configuration File without Completely Restarting WireGuard Session

On Linux systems, under bash, we can run the following command to reload and apply a revised WireGuard configuration file without restarting and distrupting the clients

wg syncconf wg0 <(wg-quick strip wg0)

Note that this command may not work for shells other than bash. However, we can always complete this in a three step fashion.

wg-quick strip wg0 > temp_wg0.conf
wg syncconf wg0 temp_wg0.conf
rm temp_wg0.conf

Quick Note on WireGuard Configuration Files

Assume that we set up a VPN server, and a number of clients are the peers of the server. Below are example configuration files

1. Server Configuration

   
   [Interface]
   Address = 10.188.0.1/32
   PrivateKey = (Private Key of the server, genreated via: wg genkey | server.private)
   ListenPort = 51820
   
   
   
   [Peer]
   PublicKey = (Public key of the client, generated via: wg genkey | tee client.2.private | wg pubkey)
   AllowedIPs = 10.188.0.2/32
   
   [Peer]
   PublicKey = (Public key of the client, generated via: wg genkey | tee client.3.private | wg pubkey)
   AllowedIPs = 10.188.0.3/32
   
   [Peer]
   PublicKey = (Public key of the client, generated via: wg genkey | tee client.4.private | wg pubkey)
   AllowedIPs = 10.188.0.4/32
   
   [Peer]
   PublicKey = (Public key of the client, generated via: wg genkey | tee client.5.private | wg pubkey)
   AllowedIPs = 10.188.0.5/32  
   

   • The AllowedIPs of the Peer section is to assign the IP address to the client.
2. Client Configuration

   
   [Interface]
   Address = 10.188.0.5/32
   PrivateKey = (Private Key of the the client, e.g., the content of client.5.private)
   DNS = 192.168.1.1,1.1.1.1,8.8.8.8
   
   
   
   [Peer]
   PublicKey = (Public key of the server, generated via: cat server.private | wg pubkey)
   AllowedIPs = 10.188.0.1/32,10.188.0.5/32
   Endpoint = Server_Public_IP_OR_Hostname:51820
   
   

   • The AllowedIPs is to control access the client has to the part of the network. My experience is that you must give the access to the server, i.e., it must include server's IP address 10.188.0.1; otherwise, there would be a reachability problem.
   • Since it is a client, we should also inclue the Endpoint.
   • Numerous examples on the Web often use AllowedIPs = 0.0.0.0/0,::/0 as part of the client configuration. Although a further investigation is needed to confirm it, my experience is that this can be a problematic setup for Windows clients, in particular, both the server and the client reside in private networks with the same network prefix, e.g., 192.168.1.0/24. Windows does not appear to set up proper routes and appears to be confused with which private network it should reach when given an IP address like 192.168.1.1. My experience seems to be when this happens, Ping on Windows would report "General Failure."

Running WireGuard Windows GUI Client as Non-administrator User

As indicated in this document, and also referenced in several places, we can run the WireGuard Windows GUI client as a non-administrator user with the functionality limited to toggle on or off the existing VPN tunnel configuration created.

This generally involves two steps as an administrator on the Windows host:

1. Create a registration key, which is specified in the command below

   
       reg add HKLM\Software\WireGuard /v LimitedOperatorUI /t REG_DWORD /d 1 /f
       

2. Add the non-administrator user we wish to be able to toggle on/off the tunnel to the the Network Configuration Operators builtin group. We can do this by invoking the lusrmgr command.