Learn WireGuard - Tools & Monitoring

#Introduction

WireGuard ships with two main tools: wg for managing configuration and state directly, and wg-quick for conveniently bringing interfaces up and down. Mastering both means you can diagnose problems, change peers live, and build reliable monitoring.

Episode 8 dissects every important command, reads health metrics such as handshake and transfer, and then assembles a bash script for health checks. These skills will keep being used right up to episode 21, when we talk about observability in production.

#The wg Command

#Reading Status

The basic commands for viewing the state of all interfaces and of one specific interface:

sudo wg show
sudo wg show wg0
sudo wg show wg0 transfer
sudo wg show wg0 latest-handshakes

The wg show output displays the public key, listen port, and the peer list. transfer shows the number of bytes sent and received per peer, while latest-handshakes shows the time of the last handshake as a UNIX timestamp.

#Configuration and Set

wg showconf prints the current configuration in wg0.conf format, while wg set changes attributes live:

sudo wg showconf wg0
sudo wg set wg0 listen-port 51821
sudo wg set wg0 peer <PUBLIK_CLIENT> remove

wg set wg0 peer ... remove removes a peer without taking the interface down — very useful for revoking access instantly. For single-line changes, wg set is more appropriate than rewriting the configuration file.

#Dump Format

For scripting, wg show wg0 dump prints the entire state as one line per interface and per peer, easy to parse with awk or cut:

sudo wg show wg0 dump

#The wg-quick Command

#Up, Down, Strip, Save

wg-quick is a wrapper that reads files in /etc/wireguard/, creates the interface, assigns the address, adds routes, and runs PostUp. Its command variants:

sudo wg-quick up wg0
sudo wg-quick down wg0
sudo wg-quick strip wg0
sudo wg-quick save wg0

wg-quick save wg0 takes the runtime state and writes it back to the configuration file. This is useful when you have made many wg set changes and want to persist the results. wg-quick strip prints the configuration that would be executed, without applying it.

#systemd Integration

wg-quick integrates with systemd through a template unit:

sudo systemctl enable --now wg-quick@wg0
sudo systemctl status wg-quick@wg0

#Health Checks with a Bash Script

#Monitoring the Handshake

The following simple script ensures a peer's handshake is still fresh. If the last handshake is too old, the script warns:

#!/usr/bin/env bash
WANTED_PEER="<PUBLIK_CLIENT>"
MAX_AGE=180
NOW=$(date +%s)
LAST=$(sudo wg show wg0 latest-handshakes | grep "$WANTED_PEER" | awk '{print $2}')
AGE=$((NOW - LAST))
if [ "$AGE" -gt "$MAX_AGE" ]; then
    echo "WARNING: handshake peer berumur ${AGE} detik"
else
    echo "OK: handshake berumur ${AGE} detik"
fi

The script above reads latest-handshakes, computes the handshake age, and warns when the threshold is exceeded. Run it via cron every minute for periodic monitoring.

#Monitoring Transfer

To ensure traffic is flowing in both directions, watch the transfer counter at two points in time and compare the difference:

RX1=$(sudo wg show wg0 transfer | awk '/<PUBLIK_CLIENT>/{print $4}')
sleep 10
RX2=$(sudo wg show wg0 transfer | awk '/<PUBLIK_CLIENT>/{print $4}')
echo "Pertambahan receive dalam 10 detik: $((RX2 - RX1)) byte"

If the difference is always zero despite activity, something is wrong with the route or the encryption direction — usually because AllowedIPs on one side does not cover the required subnet.

#Closing

Episode 8 completed your monitoring toolkit: the wg commands for status and live changes, wg-quick for bringing interfaces up and down, and bash scripts for handshake and transfer health checks.

Key takeaways:

• wg show for status; wg showconf for a configuration dump.
• wg set changes attributes live without a restart.
• wg-quick up/down/strip/save manages the interface life cycle.
• A zero latest-handshakes means the peer has never handshaked.
• transfer shows bytes sent and received per peer.
• Health check scripts can be scheduled via cron for monitoring.

In episode 9 we enter the workload phase: site-to-site VPN — connecting two office networks over WireGuard, choosing between full mesh and hub-and-spoke topology, and setting up static routing and firewall rules between sites.