WireGuard

The client can create a WireGuard TUN interface for TCP, UDP, and ICMP traffic through an agent without relying on a SOCKS proxy. The agent must have WireGuard enabled; see Agent WireGuard.

Prerequisites

• Enable wg-enabled on the agent.
• Install wg-quick on Linux or macOS, or WireGuard on Windows.
• Confirm that the client can connect to the agent.

Quick usage

Generate a client key pair:

tealc wireguard generate

Add the printed wg-public-key, wg-private-key, and wg-ip values to the client configuration, then start the interface:

tealc wireguard start AGENT_NAME

Verify the interface with the operating system’s network tools, then test a known address reachable from the agent. tealc wireguard start remains in the foreground while the interface is active. Press Ctrl-C to stop the command; tealc then tears down the WireGuard interface automatically.

Generated configuration

tealc wireguard generate prints values like these for you to add to tealc.yaml:

wireguard:
  start:
    wg-public-key: yIBaM2WHj9gDcxRxIFtvKrxj6jrosjYsaP34i7BkJ2A=
    wg-private-key: dPu5bpPpZLDi4t40iHDz+KCkIh0za32Jz+uxNdVth0Q=
    wg-ip: 100.125.104.221

The displayed keys are examples only. Generate a new key pair for each operator workstation and do not commit the private key. These values are persistent client settings stored in tealc.yaml.

Runtime interface file

When the interface starts, tealc creates a separate WireGuard runtime configuration at:

[OS user cache directory]/tealc/[transformed-agent-id].conf

This runtime file is not tealc.yaml: it contains the generated interface configuration used by wg-quick or WireGuard for the active connection. Its filename uses the first 15 characters of the agent ID. The file is readable and writable only by the current user.

Options

• --ranges: comma-separated IP ranges to route through the WireGuard VPN.
• --auto-ranges: automatically set the ranges from the agent.
• --loopback: use the loopback interface with the 240.0.0.0/8 address range.
• --exec / --no-exec: execute WireGuard commands directly by default. Use --no-exec to print the commands and configuration path without running them.
• --port: local port to bind the WireGuard proxy.
• --wg-public-key: WireGuard public key, passed directly instead of via the generated configuration file.
• --wg-private-key: WireGuard private key, passed directly instead of via the generated configuration file.
• --wg-ip: WireGuard tunnel IP address, passed directly instead of via the generated configuration file.