/flags/wireguard/wg-set-peer-remove
wg set wg0 peer KEY remove: remove a WireGuard peer from a running interface
- tool
- WireGuard
- command
- wg set
- flag
- peer PUBLIC_KEY remove
- default
- peer arguments without remove add or update the peer
sudo wg set wg0 peer 'xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=' remove deletes that peer from the running wg0 interface immediately. The wg(8) manual describes it under set: multiple peers may be specified, and "if the remove argument is given for a peer, that peer is removed, not configured". Other peers and their sessions are not affected, so this is how you revoke a lost laptop or a departed user's device without restarting the VPN.
Remove, verify, persist
sudo wg show wg0 peers # list peer public keys
sudo wg set wg0 peer 'PEER_PUBLIC_KEY=' remove # remove from the running interface
sudo wg show wg0 peers # the key is gone
sudo wg-quick save wg0 # write the running state to wg0.confwg-quick save saves the configuration of an existing interface without bringing it down. If you manage wg0.conf by hand or with configuration management, delete the [Peer] section there instead; otherwise the next wg-quick up restores the peer.
Related wg set arguments for peers
| Argument | Effect |
|---|---|
| peer KEY remove | Remove the peer |
| peer KEY allowed-ips LIST | Replace the allowed IPs (+ / - prefixes for incremental changes) |
| peer KEY endpoint IP:PORT | Set the endpoint |
| peer KEY persistent-keepalive N | Keepalive interval in seconds, 0 or off to disable |
| peer KEY preshared-key FILE | Set the preshared key; /dev/null removes it |
Several peer blocks can be combined in one command, for example removing one device and adding its replacement at the same time; adding peers is covered in add a peer without restarting.
Pitfalls
- Quote the key. Public keys are base64 and may contain
+and/; quoting avoids surprises in shells and scripts. - SaveConfig. With
SaveConfig = truein the[Interface]section, wg-quick writes the running state to the file at shutdown, so changes made to the file while the interface is up are overwritten; the removal made withwg setis then kept automatically. - Revoke keys properly. Removing the peer is enough to block it; generate a fresh key pair for the replacement device with wg genkey instead of reusing old keys.
- File permissions. wg-quick warns when the configuration file is readable by others; see configuration file is world accessible.
To confirm which peers remain and when they last connected, use wg show dump.
FAQ
Does wg set ... remove change /etc/wireguard/wg0.conf?
No. wg changes only the running interface. Remove the [Peer] section from the file as well, or run wg-quick save wg0 afterwards, otherwise the peer comes back at the next wg-quick up.
Can a removed peer still connect?
No. Without a peer entry for its public key, the interface drops its handshake attempts. To block a device permanently, also make sure its public key is not re-added from a backup or configuration management.
What happens if the key does not match any peer?
The command has nothing to remove. Check the exact base64 key, including the trailing =, with wg show wg0 peers.