Where Are WireGuard Config Files Stored?
WireGuard defines each tunnel as one .conf file under /etc/wireguard, private key and peer list included.
Last updated
A WireGuard tunnel is a text file. Interface address and private key go in an Interface section, each peer gets a Peer section with its public key, endpoint, and allowed IPs. Copy the file, adjust keys, done.
The convention names files after interfaces: wg0.conf becomes the wg0 interface under wg-quick. Keep private keys out of backups that leave your control and out of shell history when generating them. A leaked key means rekeying every peer, which is exactly as fun as it sounds.
Where WireGuard stores this, by platform
/etc/wireguard/wg0.conf
One .conf per tunnel, named for its interface. Bring tunnels up with wg-quick up wg0 and inspect with wg show. Private keys sit inside, so keep the directory root only.
Frequently asked questions
What permissions should the config have?
Root only, 600. The file contains the private key in plain text, so readable by group or others is a genuine incident, not a warning to silence. Set it at creation and check after edits.
Can one machine run several tunnels?
Yes. wg0, wg1, each with its own file and keys. Bring them up independently with wg-quick up and down per name. Separate files beat one clever file every time.
Notice an outdated path? Let us know.