Given a Wireguard client configuration file, I guess some of the fields shouldn't be shared with just anyone, like the private key, right?

Is there any other field that should be treated as a confidential value? I want to add the client config file to a repo for automation in my environment.

  • So, can you be more specific? What fields? address, DNS, server endpoint IP, and allowed IPs?
    – schroeder
    Commented Feb 1 at 12:53
  • Under Interface I have: Address, PrivateKey and DNS. Under Peer, I have PublicKey, PresharedKey, Endpoint, AllowedIPs and PersistentKeepalive. Which of the mentioned fields should be kept secret?
    – matteo-g
    Commented Feb 1 at 14:00
  • Right, so besides the keys (which you identified) you have: IPs, DNS server, and the PersistentKeepalive setting. Do you have the need to keep any of those IPs secret? What would be the impact iff they were known?
    – schroeder
    Commented Feb 1 at 14:03
  • I think the PersistentKeepalive is definitely not a secret. I'm doubting about the rest though.
    – matteo-g
    Commented Feb 1 at 14:12
  • 2
    @schroeder What's the reasoning for keeping the pubkey secret? Genuinely wondering...
    – vidarlo
    Commented Feb 1 at 18:59

1 Answer 1


The PrivateKey and PresharedKey fields are secrets.

The rest of the fields in a WireGuard config file could conceivably be useful to an adversary for reconnaissance purposes (eg to compile a list of which users have access to a particular system, or to find IPs to DDoS, etc) -- but they're not secrets from the perspective of WireGuard's design (ie their disclosure would not give a meaningful advantage to an adversary trying to decrypt/alter/spoof WireGuard messages).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .