WireGuard (wg0.conf) Config, Keypair & Split-Tunnel CIDR Calculator (2026)

WireGuard's Cryptokey Routing design intentionally binds every peer's public key directly to a positive list of permitted source/destination CIDR blocks (AllowedIPs). To route all internet traffic through the VPN while excluding RFC 1918 local networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), you replace 0.0.0.0/0 with the complement set of 19 CIDR blocks that mathematically cover the rest of the IPv4 space.

A standard Ethernet frame has a 1500-byte Maximum Transmission Unit (MTU). WireGuard encapsulates inner packets inside UDP: adding a 20-byte IPv4 header (or 40-byte IPv6 header), an 8-byte UDP header, a 4-byte WireGuard type/reserved field, a 4-byte key index, an 8-byte ChaCha20 nonce counter, and a 16-byte Poly1305 authentication tag. Over IPv6, 40 + 8 + 32 = 80 bytes of overhead, leaving 1500 − 80 = 1420 bytes for the inner payload.

WireGuard uses Curve25519 ECDH for key exchange, which is secure against classical computers but theoretically vulnerable to a future fault-tolerant quantum computer running Shor's algorithm ('harvest now, decrypt later'). Adding a symmetric 256-bit PresharedKey mixes an additional HKDF key input into the Noise_IKpsk2 handshake, achieving post-quantum resistance under Grover's algorithm.

WireGuard is cryptographically silent—if no data is being sent, it transmits zero packets. If a client sits behind a Stateful NAT router or carrier-grade NAT (CGNAT) and wants the server to be able to initiate connections back to the client, sending an authenticated empty keepalive packet every 25 seconds prevents the NAT translation table entry from expiring.

Per RFC 7748, any random 32-byte array becomes a valid X25519 private scalar by clearing the lowest 3 bits of byte 0 (byte[0] &= 248, ensuring the scalar is a multiple of the cofactor 8 to prevent small-subgroup attacks), clearing the highest bit of byte 31 (byte[31] &= 127), and setting the second-highest bit of byte 31 (byte[31] |= 64, ensuring constant-time Montgomery ladder execution).