You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
25 lines
1.2 KiB
25 lines
1.2 KiB
# refer to wireguard-proxy --help for info on what these are |
|
|
|
# this binds ipv4 and ipv6 if dual stacked |
|
WGP_TCP_HOST=[::]:5555 |
|
# this binds all ipv4 addresses |
|
#WGP_TCP_HOST=0.0.0.0:5555 |
|
|
|
WGP_UDP_TARGET=127.0.0.1:51820 |
|
|
|
# on the server you'll want to set this to slightly more than PersistentKeepalive= in your client's wireguard config |
|
# this allows the udp sockets to be closed in a reasonable amount of time after the TCP connections are terminated |
|
# if PersistentKeepalive=25 as is recommended just set this to 60 |
|
WGP_SOCKET_TIMEOUT=60 |
|
|
|
WGP_UDP_BIND_HOST_RANGE=127.0.0.1:30000-40000 |
|
|
|
# if you don't want proper cert generate with: |
|
# openssl req -new -x509 -sha256 -days 3650 -nodes -subj "/C=US/CN=example.org" -newkey rsa:2048 -out cert.pem -keyout key.pem |
|
# if systemd template has SupplementaryGroups=systemd-network set permissions on key properly: |
|
# chown root.systemd-network key.pem && chmod 640 key.pem |
|
# optionally (but recommended) extract pinnedpubkey hash from the above generated cert like so: |
|
# openssl x509 -in cert.pem -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64 |
|
#WGP_TLS_KEY=/etc/wireguard-proxy/key.pem |
|
#WGP_TLS_CERT=/etc/wireguard-proxy/cert.pem |
|
|
|
|