WireGuard config generator
Generate a WireGuard key pair and a starter config entirely in your browser — the same client-side key generation vpn.golf uses.
How to use the wireguard config generator
- Press Generate to create a key pair locally.
- Fill the [Peer] section with your server's public key and endpoint.
- Download wg0.conf and import it into the WireGuard app.
What to do with this
Fill in the [Peer] section with your server's public key and endpoint (vpn.golf does this for you when you play a hole), import the file into the WireGuard app, and connect. New to this? See our setup guide.
Code & API examples
Use this from the command line or your code.
Keys with the wg CLI
wg genkey | tee privatekey | wg pubkey > publickeySee all endpoints at /api/tools/.
Frequently asked questions
Only if the keys are generated in your browser and never transmitted — which is how this tool works. The private key never leaves your device, and vpn.golf never receives it.
Your server's public key, its endpoint (host:port), and AllowedIPs. With vpn.golf, those are filled in automatically when you play a hole.
On the client it sets which traffic goes through the tunnel: 0.0.0.0/0, ::/0 routes everything (full VPN), while a narrower range like 10.0.0.0/24 makes it split-tunnel and only reaches specific hosts.
It's the private IP your device holds inside the tunnel, assigned by the server — for example 10.7.0.2/32. It is not your public IP and is unique to this peer.
Only if you're behind NAT or a firewall that drops idle UDP. Setting PersistentKeepalive = 25 sends a small packet every 25 seconds so the connection stays reachable; otherwise leave it off.
Save the file, then in the WireGuard app choose Add Tunnel and import from file, or scan the QR code on mobile. On Linux, copy it to /etc/wireguard/wg0.conf and run wg-quick up wg0.
Usually a wrong endpoint or public key, a blocked UDP port, or DNS set to an unreachable resolver. Confirm the [Peer] endpoint and PublicKey exactly match the server, and that the server allows your UDP port.
Yes — add a DNS line under [Interface], e.g. DNS = 10.7.0.1. This routes lookups through the tunnel's resolver so requests aren't leaked to your local network's DNS.
A key pair is just two values; a config is the full file that combines your private key, tunnel address, DNS, and the [Peer] block needed to actually establish a connection.
Yes — it's a plain text file. You can change DNS, AllowedIPs, MTU, or the endpoint at any time, then re-import it. The private key stays valid as long as you keep the same [Interface] PrivateKey.
It's optional but recommended for extra defense-in-depth. Generate one, put the same value under PresharedKey in both peers' [Peer] sections, and it adds a symmetric layer to the handshake.
Remove the device's public key from the server's peer list — with vpn.golf you revoke the device in the clubhouse. The config file becomes inert because the server no longer recognizes its key.
Want to hide your IP for real?
vpn.golf is a no-logs WireGuard VPN. Pick a hole, take the shot.
Step up to the tee — free