1.7 KiB
WireGuard
User-space WireGuard protocol implementation.
::: danger The WireGuard protocol is not designed specifically for bypassing firewalls. If used as the outer layer to cross the firewall, its distinct characteristics may lead to the server being blocked. :::
InboundConfigurationObject
InboundConfigurationObject corresponds to the settings item in InboundObject.
{
"inbounds": [
{
// ...
"settings": {
// [!code focus:8]
"secretKey": "PRIVATE_KEY",
"peers": [
{
"publicKey": "PUBLIC_KEY",
"allowedIPs": [""]
}
],
"mtu": 1420 // optional, default 1420
}
}
]
}
secretKey: string
Private key. Required.
mtu: int
The MTU size of the underlying WireGuard TUN.
Method to Calculate MTU
The structure of a WireGuard packet is as follows:
- 20-byte IPv4 header or 40 byte IPv6 header
- 8-byte UDP header
- 4-byte type
- 4-byte key index
- 8-byte nonce
- N-byte encrypted data
- 16-byte authentication tag
N-byte encrypted data is the MTU value we need. Depending on whether the endpoint is IPv4 or IPv6, the specific value can be 1440 (IPv4) or 1420 (IPv6). If you are in a special network environment, you may need to subtract more (e.g., home broadband PPPoE requires an extra -8).
peers: [ Peers ]
List of peers, where each item is a peer configuration.
Peers
{
"publicKey": "PUBLIC_KEY",
"allowedIPs": ["0.0.0.0/0"] // optional, default ["0.0.0.0/0", "::/0"]
}
publicKey: string
Public key, used for verification.
allowedIPs: string array
Allowed source IPs.