Manual Pages  — WG

Alternatively, to load the driver as a module at boot time, place the following line in loader.conf(5):

if_wg_load="YES"

The interfaces can be created at runtime using the ifconfig wgN create command. The interface itself can be configured with wg(8).

The following glossary provides a brief overview of WireGuard terminology:

Peer	Peers exchange IPv4 or IPv6 traffic over secure tunnels. Each wg interface may be configured to recognise one or more peers.
Key	Each peer uses its private key and corresponding public key to identify itself to others. A peer configures a wg interface with its own private key and with the public keys of its peers.
Pre-shared key
	In addition to the public keys, each peer pair may be configured with a unique pre-shared symmetric key. This is used in their handshake to guard against future compromise of the peers' encrypted tunnel if an attack on their Diffie-Hellman exchange becomes feasible. It is optional, but recommended.
Allowed IP addresses
	A single wg interface may maintain concurrent tunnels connecting diverse networks. The interface therefore implements rudimentary routing and reverse-path filtering functions for its tunneled traffic. These functions reference a set of allowed IP address ranges configured against each peer. The interface will route outbound tunneled traffic to the peer configured with the most specific matching allowed IP address range, or drop it if no such match exists. The interface will accept tunneled traffic only from the peer configured with the most specific matching allowed IP address range for the incoming traffic, or drop it if no such match exists. That is, tunneled traffic routed to a given peer cannot return through another peer of the same wg interface. This ensures that peers cannot spoof one another's traffic.
Handshake
	Two peers handshake to mutually authenticate each other and to establish a shared series of secret ephemeral encryption keys. Either peer may initiate a handshake. Handshakes occur only when there is traffic to send, and recur every two minutes during transfers.
Connectionless
	Due to the handshake behavior, there is no connected or disconnected state.

Keys can be generated with wg(8) as follows:

    $ wg genkey

Although a valid Curve25519 key must have 5 bits set to specific values, this is done by the interface and so it will accept any random 32-byte base64 string.

WireGuard whitepaper,