I was using wg-quick at home + work but it got tedious to add peers and track what key was for what peer.<p>I looked around but I considered the available wireguard GUIs / tools (such as subspace) to be too heavyweight and/or have a few security concerns.<p>So, I wrote dsnet in go. dsnet manages subnet generation, IP allocation, key generation and peer management.<p>* A sane and working server peer configuration is generated with a single command
* Client peers are added/removed with a single command
* A JSON report suitable for producing a HTML rendered peer status display can be generated with one command<p>There's more in-depth information on the github README, and background + a tutorial on my website: <a href="https://callanbryant.co.uk/blog/how-to-set-up-a-wireguard-vpn-in-minutes-with-dsnet/" rel="nofollow">https://callanbryant.co.uk/blog/how-to-set-up-a-wireguard-vp...</a><p>Thanks for reading!
> The peer private key is generated on the server, which is technically not as secure as generating it on the client peer and then providing the server the public key<p>"Not as secure" means specifically this punts all the actual security of the system.<p>This is one of the sad but predictable thing with designs like WireGuard that themselves decided to punt this hard problem (you can also see it in OpenVPN [edited: Let's blame an early morning for me writing OpenSSL there] and with the same consequences). So in one sense it isn't your fault - Jason knew this was hard but left it for you to solve anyway, and predictably you didn't.<p>But of course for the end user the practical result is that they maybe don't get the security benefits they were told were available in WireGuard.<p>My crystal ball is cloudy but I'd guess that one possible future for WireGuard is that it gradually grows a reputation for insecurity not because WireGuard the protocol is bad but because the way it's used has meant almost invariably bad guys get private keys they shouldn't have.
Can someone guide me to how wg decides on whether a route push created by wg becomes default or not? Don't see a config option to decide that in dsnet