> ## Documentation Index
> Fetch the complete documentation index at: https://tunnelfleet.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# WireGuard

> Use WireGuard with TunnelFleet — ports, configs, and client setup overview.

WireGuard is the fastest protocol TunnelFleet supports. Each VPN user gets a unique key pair and peer configuration.

## Defaults

| Setting              | Value                                    |
| -------------------- | ---------------------------------------- |
| Port                 | **51820/UDP**                            |
| Interface config     | Downloaded as `{server}-{user}-wg0.conf` |
| DNS (typical)        | `1.1.1.1`                                |
| AllowedIPs (typical) | `0.0.0.0/0` (full tunnel)                |

## How TunnelFleet models WireGuard users

WireGuard users are **key-based peers**, not username/password tunnels.

1. Create or select a user on the server **Users** tab
2. Download the `.conf` file or scan the QR code
3. Import into the official WireGuard app
4. Activate the tunnel

Panel passwords apply to OpenVPN (and similar password protocols), not to WireGuard handshakes.

## Client platforms

<Columns cols={2}>
  <Card title="Windows" href="/docs/wireguard/windows" icon="windows">
    Install WireGuard for Windows and import a tunnel.
  </Card>

  <Card title="macOS" href="/docs/wireguard/macos" icon="apple">
    Use the Mac App Store WireGuard client.
  </Card>

  <Card title="Ubuntu" href="/docs/wireguard/ubuntu" icon="linux">
    Import with `wg-quick` on Ubuntu.
  </Card>

  <Card title="Android" href="/docs/wireguard/android" icon="mobile">
    Import via file or QR code.
  </Card>

  <Card title="iPhone" href="/docs/wireguard/iphone" icon="mobile">
    Scan the QR code in the iOS WireGuard app.
  </Card>

  <Card title="Android TV" href="/docs/wireguard/android-tv" icon="tv">
    Set up WireGuard on Android TV devices.
  </Card>

  <Card title="GL.iNet router" href="/docs/wireguard/gl-inet" icon="router">
    Run WireGuard on a GL.iNet travel router.
  </Card>
</Columns>

## Firewall

Allow **UDP 51820** on the VPS and in any cloud security group. If the protocol was reinstalled, use **Protocols → Repair Firewall** to re-apply host rules.

## Troubleshooting

* Handshake never completes → UDP 51820 blocked or wrong public endpoint
* Connected but no browsing → DNS or routing; confirm `DNS = 1.1.1.1` and `AllowedIPs = 0.0.0.0/0`
* On iOS, avoid multiple DNS servers in one line — use a single DNS entry

For live server-side detail, open [Observe logs](/docs/servers/logs).