wireguard

wireguard — WireGuard Settings

Properties

Table 89. 

Key Name Value Type Default Value Value Description
fwmark
uint32
0
The use of fwmark is optional and is by default off. Setting it to 0 disables it. Otherwise, it is a 32-bit fwmark for outgoing packets. Note that "ip4-auto-default-route" or "ip6-auto-default-route" enabled, implies to automatically choose a fwmark.
ip4-auto-default-route
NMTernary (int32)
Whether to enable special handling of the IPv4 default route. If enabled, the IPv4 default route from wireguard.peer-routes will be placed to a dedicated routing-table and two policy routing rules will be added. The fwmark number is also used as routing-table for the default-route, and if fwmark is zero, an unused fwmark/table is chosen automatically. This corresponds to what wg-quick does with Table=auto and what WireGuard calls "Improved Rule-based Routing". Note that for this automatism to work, you usually don't want to set ipv4.gateway, because that will result in a conflicting default route. Leaving this at the default will enable this option automatically if ipv4.never-default is not set and there are any peers that use a default-route as allowed-ips.
ip6-auto-default-route
NMTernary (int32)
Like ip4-auto-default-route, but for the IPv6 default route.
listen-port
uint32
0
The listen-port. If listen-port is not specified, the port will be chosen randomly when the interface comes up.
mtu
uint32
0
If non-zero, only transmit packets of the specified size or smaller, breaking larger packets up into multiple fragments. If zero a default MTU is used. Note that contrary to wg-quick's MTU setting, this does not take into account the current routes at the time of activation.
peer-routes
boolean
TRUE
Whether to automatically add routes for the AllowedIPs ranges of the peers. If TRUE (the default), NetworkManager will automatically add routes in the routing tables according to ipv4.route-table and ipv6.route-table. Usually you want this automatism enabled. If FALSE, no such routes are added automatically. In this case, the user may want to configure static routes in ipv4.routes and ipv6.routes, respectively. Note that if the peer's AllowedIPs is "0.0.0.0/0" or "::/0" and the profile's ipv4.never-default or ipv6.never-default setting is enabled, the peer route for this peer won't be added automatically.
peers
array of 'a{sv}'
Array of dictionaries for the WireGuard peers.
private-key
string
The 256 bit private-key in base64 encoding.
private-key-flags
NMSettingSecretFlags (uint32)
Flags indicating how to handle the "private-key" property.