/commands/wireguard/add-peer-without-restart
wg set wg0 peer KEY allowed-ips IP: add a WireGuard peer without restarting
- tool
- WireGuard
- versions
- wireguard-tools 1.0
- os
- linux, macos
sudo wg set wg0 peer PUBLIC_KEY allowed-ips 10.0.0.3/32 adds a peer to the running interface wg0 at once, without touching other peers or restarting the tunnel. The change lives only in the kernel until you also add it to /etc/wireguard/wg0.conf. If you edit the file first instead, sudo wg syncconf wg0 <(wg-quick strip wg0) applies the difference without disrupting active sessions.
Two ways to add a peer
Directly on the interface, then saved to the file:
sudo wg set wg0 peer 'CLIENT_PUBLIC_KEY=' allowed-ips 10.0.0.3/32
sudo wg show wg0 allowed-ips # the new key should be listed
sudo wg-quick save wg0 # write the running config to /etc/wireguard/wg0.confOr in the file first, then synced:
sudo tee -a /etc/wireguard/wg0.conf >/dev/null <<'EOF'
[Peer]
PublicKey = CLIENT_PUBLIC_KEY=
AllowedIPs = 10.0.0.3/32
EOF
sudo bash -c 'wg syncconf wg0 <(wg-quick strip wg0)'Replace CLIENT_PUBLIC_KEY= with the client's base64 public key (from wg pubkey, see generate keys). The <( ) process substitution needs bash, which is why the second form runs through bash -c under sudo. With the systemd unit, sudo systemctl reload wg-quick@wg0 runs the same syncconf command.
wg set options for peers
| Argument | Effect |
|---|---|
| peer KEY allowed-ips 10.0.0.3/32 | Create the peer, or replace its allowed IPs if it exists. |
| allowed-ips +10.0.5.0/24 | Add a network to the existing list instead of replacing it (- removes one). |
| endpoint 203.0.113.10:51820 | Set where to send packets; needed on the side that starts the connection. |
| persistent-keepalive 25 | Send a keepalive every 25 seconds, for peers behind NAT; 0 or off disables it. |
| preshared-key FILE | Add a pre-shared key from a file (an extra symmetric layer). |
| peer KEY remove | Delete the peer from the running interface. |
Pitfalls
allowed-ipsreplaces the previous list unless each entry starts with+. Runningwg set ... allowed-ips 10.0.5.0/24on an existing peer silently drops its old networks.allowed-ips ""(an empty value) removes every allowed IP from the peer, so it no longer receives traffic.- With
SaveConfig = truein the file,wg-quick downoverwrites the file with the running state, discarding edits made in the meantime. wg syncconf wg0 /etc/wireguard/wg0.confwithoutwg-quick stripfails onAddress,DNSand other wg-quick keys, becausewgonly understands its own keys.
Confirm the result with sudo wg show wg0: the new peer appears at once, and its latest handshake line shows up after the client connects. If it never does, see check WireGuard status.
FAQ
Why did my new peer disappear after a reboot?
wg set changes only the running interface. Add the [Peer] section to /etc/wireguard/wg0.conf, or run sudo wg-quick save wg0 to write the running state to the file.
Do existing clients lose their connection when I run wg syncconf?
No. syncconf reads the current configuration and changes only what differs from the file, so sessions of unchanged peers keep running. wg setconf replaces everything and can interrupt them.
Does the new client need a route on the server?
When the client's tunnel address is inside the subnet of the server's Address line (for example 10.0.0.3 in 10.0.0.1/24), wg-quick already added that route. A peer that routes other networks needs a route for them, which wg set does not add.