# Telnyx Compute: WireGuard Interfaces — Full Documentation > Complete page content for WireGuard Interfaces (Compute section) of the Telnyx developer docs (https://developers.telnyx.com). > This file: https://developers.telnyx.com/docs/development/llms/compute-wireguard-interfaces-llms-full-txt · Root index: https://developers.telnyx.com/llms.txt ## Get Started ### Overview > Source: https://developers.telnyx.com/docs/network/wireguard-interfaces.md A WireGuard Interface is an interface on a Network. Any host can connect to it as a **peer** over a WireGuard tunnel, and an Edge Compute function joins as a peer through a [network binding](/docs/edge-compute/runtime/bindings/network). Peers reach each other, and the rest of the Network, via the interface. ## Interface and peers The interface and its peers share one subnet. The interface takes the first address, and each peer gets the next free one. Each peer opens its own tunnel to the interface's public endpoint, so a peer needs no inbound firewall rule. Each peer has its own WireGuard key pair. Telnyx generates the pair and returns the private key once, or the peer keeps its private key and registers only the public key. ## Pricing | Resource | Monthly recurring charge (USD) | | ------------------- | ------------------------------ | | WireGuard Interface | 10 | | Peer | Free | --- ### Quick Start > Source: https://developers.telnyx.com/docs/network/wireguard-interfaces/quick-start.md ## Prerequisites - A host with WireGuard installed: [Linux](/docs/network/wireguard-peer-config/linux), [macOS](/docs/network/wireguard-peer-config/macos), or [Windows](/docs/network/wireguard-peer-config/windows). - A region that offers WireGuard Interfaces. `GET /v2/network_coverage?filter[available_services][contains]=cloud_vpn` lists them. A location's `location.code`, such as `ashburn-va`, is the `region_code` to use. - A Network. [`POST /v2/networks`](/api-reference/networks/create-a-network) with `{"name": "acme-prod"}` returns its `id`. ## Create the interface Send [`POST /v2/wireguard_interfaces`](/api-reference/wireguard-interfaces/create-a-wireguard-interface): ```json { "network_id": "0de011ae-ee53-4df4-ba96-754728eb5aad", "name": "wg-ashburn", "region_code": "ashburn-va" } ``` An interface cannot move to another Network. Confirm `network_id` before sending the request. The response returns `status: provisioning` and the values that peers need: `endpoint`, `public_key`, and `server_ip_address`. ```json { "data": { "name": "wg-ashburn", "status": "provisioning", "created_at": "2026-10-09T23:03:28.957851Z", "region_code": "ashburn-va", "enable_sip_trunking": false, "public_key": "dM4BrhaKqRVoq+mMD+4mmQ5KTFkcutiXnfN2Ztk+3Sw=", "id": "749de8c6-bbd0-42dd-9a16-770a519b565d", "updated_at": "2026-10-09T23:03:31.009085Z", "network_id": "0de011ae-ee53-4df4-ba96-754728eb5aad", "region": { "code": "ashburn-va", "name": "Ashburn VA, US", "record_type": "region" }, "record_type": "cloud_vpn", "endpoint": "64.16.243.3:5134", "server_ip_address": "172.27.0.1/24" } } ``` ## Wait for provisioning Poll [`GET /v2/wireguard_interfaces/{id}`](/api-reference/wireguard-interfaces/retrieve-a-wireguard-interfaces) until `status` is `provisioned`. This takes a few minutes. Peers can be added once it is provisioned. ## Create a peer Register the host as a peer of the WireGuard Interface with [`POST /v2/wireguard_peers`](/api-reference/wireguard-interfaces/create-a-wireguard-peer): ```json { "name": "laptop", "wireguard_interface_id": "749de8c6-bbd0-42dd-9a16-770a519b565d" } ``` Telnyx generates the host's key pair and returns its `private_key` once, in this response. Store it. ```json { "data": { "name": "laptop", "created_at": "2026-10-09T23:06:14.665447Z", "public_key": "mOlLNRWGCiSkXpBXKMeC6QvTNRTb7lVMaa/GrOIskm8=", "updated_at": "2026-10-09T23:06:15.052007Z", "last_seen": null, "wireguard_interface_id": "749de8c6-bbd0-42dd-9a16-770a519b565d", "id": "79701b5e-9d7f-4dd1-8b80-45bae4304856", "record_type": "wireguard_peer", "private_key": "" } } ``` To keep the private key on the host instead, generate the key pair there and send only the public key as `public_key`. The response then has no `private_key`. ```bash umask 077 wg genkey | tee peer.key | wg pubkey ``` ## Configure the host [`GET /v2/wireguard_peers/{id}/config`](/api-reference/wireguard-interfaces/retrieve-wireguard-config-template-for-peer) returns a configuration template as plain text: ```ini # Telnyx CloudVPN config. Target OS: Linux [Interface] PrivateKey = Address = 172.27.0.2/32 [Peer] PublicKey = dM4BrhaKqRVoq+mMD+4mmQ5KTFkcutiXnfN2Ztk+3Sw= AllowedIPs = 172.27.0.0/24 Endpoint = 64.16.243.3:5134 PersistentKeepalive = 1 ``` The file describes the tunnel from the host's side: `[Interface]` is the local host itself, and `[Peer]` is the WireGuard Interface in Telnyx. | Section | Field | Value | | ------------- | --------------------- | --------------------------------------------------------------------------------------------------------------------- | | `[Interface]` | `PrivateKey` | The host's private key, in place of the placeholder. | | `[Interface]` | `Address` | The host's address on the WireGuard Interface's subnet. The first host gets the address after the WireGuard Interface. | | `[Peer]` | `PublicKey` | The WireGuard Interface's `public_key`. | | `[Peer]` | `AllowedIPs` | The prefixes that the host routes via the tunnel, starting with the WireGuard Interface's subnet. | | `[Peer]` | `Endpoint` | The WireGuard Interface's `endpoint`. | | `[Peer]` | `PersistentKeepalive` | How often, in seconds, the host sends a keepalive to the WireGuard Interface. | Replace the placeholder with the host's private key and save the file as `/etc/wireguard/wg0.conf`. On Linux, bring the tunnel up: ```bash sudo wg-quick up wg0 ``` ## Verify `sudo wg show` lists the local host as `interface` and the WireGuard Interface in Telnyx as `peer`, with a recent handshake: ```text interface: wg0 public key: mOlLNRWGCiSkXpBXKMeC6QvTNRTb7lVMaa/GrOIskm8= private key: (hidden) listening port: 48065 peer: dM4BrhaKqRVoq+mMD+4mmQ5KTFkcutiXnfN2Ztk+3Sw= endpoint: 64.16.243.3:5134 allowed ips: 172.27.0.0/24 latest handshake: 1 second ago transfer: 124 B received, 180 B sent persistent keepalive: every 1 second ``` The WireGuard Interface answers on its address: ```bash ping -c 3 172.27.0.1 ``` [`GET /v2/wireguard_peers/{id}`](/api-reference/wireguard-interfaces/retrieve-the-wireguard-peer) reports the peer's `last_seen` time. --- ## Configure Peers ### Linux > Source: https://developers.telnyx.com/docs/network/wireguard-peer-config/linux.md ## Prerequisite You have a `.conf` file from the [Quick Start](/docs/network/wireguard-interfaces/quick-start). ## Step 1: Install WireGuard `ubuntu@ip-10-10-11-10:~$ sudo apt install wireguard` ## Step 2: Bring up the Interface Assuming the correct config file is located at `/etc/wireguard/peer1.conf` ``` ubuntu@ip-10-10-11-10:~$ sudo wg-quick up peer1 [#] ip link add peer1 type wireguard [#] wg setconf peer1 /dev/fd/63 [#] ip -4 address add 172.27.0.2/32 dev peer1 [#] ip link set mtu 8921 up dev peer1 [#] ip -4 route add 172.27.0.0/24 dev peer1 ``` ## Step 3: Validating and Testing ``` ubuntu@ip-10-10-11-10:~$ sudo wg show interface: peer1 public key: Jt1zAJD6W2BZgOwtUsNY2KrMO0oRfUmfAEZGNEUZKiQ= private key: (hidden) listening port: 43548 peer: XYy8e5EKtE1F0fwwMgr792/9noYs53uRZBX5O3XJ4Eg= endpoint: 64.16.243.3:5107 allowed ips: 172.27.0.0/24 latest handshake: 1 minute, 28 seconds ago transfer: 92 B received, 2.86 KiB sent persistent keepalive: every 1 second ``` If another peer is connected to the network, it should be pingable. ``` ubuntu@ip-10-10-11-10:~$ ping 172.27.0.3 PING 172.27.0.3 (172.27.0.3) 56(84) bytes of data. 64 bytes from 172.27.0.3: icmp_seq=1 ttl=63 time=25.8 ms 64 bytes from 172.27.0.3: icmp_seq=2 ttl=63 time=25.6 ms 64 bytes from 172.27.0.3: icmp_seq=3 ttl=63 time=25.5 ms ^C --- 172.27.0.3 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2004ms rtt min/avg/max/mdev = 25.493/25.610/25.751/0.106 ms ``` ## Next Steps [WireGuard Interface Guide](/docs/network/wireguard-interfaces) outlines many use cases that may be valuable to you. --- ### macOS > Source: https://developers.telnyx.com/docs/network/wireguard-peer-config/macos.md ## Prerequisite You have a `.conf` file from the [Quick Start](/docs/network/wireguard-interfaces/quick-start). ## Step 1: Install WireGuard Client From [here](https://www.wireguard.com/install/), choose and install the macOS client. ## Step 2: Create a Tunnel "Import Tunnel(s) from File..." ![Import Tunnel(s) from File...](/assets/images/create-tunnel.png) "Activate" !["Activate"](/assets/images/activate.png) At this point, it should show "Status: Active" !["Active"](/assets/images/activate-success.png) ## Step 3: Validating and Testing A connected peer should be pingable. ``` user@macbook-pro wireguard % ping 172.27.0.3 PING 172.27.0.3 (172.27.0.3): 56 data bytes 64 bytes from 172.27.0.3: icmp_seq=0 ttl=63 time=35.006 ms 64 bytes from 172.27.0.3: icmp_seq=1 ttl=63 time=32.528 ms 64 bytes from 172.27.0.3: icmp_seq=2 ttl=63 time=33.376 ms ^C --- 172.27.0.3 ping statistics --- 3 packets transmitted, 3 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 32.528/33.637/35.006/1.028 ms ``` ## Next Steps [WireGuard Interface Guide](/docs/network/wireguard-interfaces) outlines many use cases that may be valuable to you. --- ### Windows > Source: https://developers.telnyx.com/docs/network/wireguard-peer-config/windows.md ## Prerequisite You have a `.conf` file from the [Quick Start](/docs/network/wireguard-interfaces/quick-start). ## Step 1: Install WireGuard Client From [here](https://www.wireguard.com/install/), choose and install the Windows Installer. ## Step 2: Create a Tunnel "Import Tunnel(s) from File..." ![Import Tunnel(s)](/assets/images/windows-import-tunnel.png) "Activate" ![Activate Tunnel](/assets/images/windows-activate-tunnel.png) At this point, it should show "Status: Active" ## Step 3: Validating and Testing You can try pinging to/from a connected peer. If that does not work you can also try to set up a barebones http server and hit it from the connected peer (or vice versa). An example barebones server in python: ``` import socket SERVER_HOST = "0.0.0.0" SERVER_PORT = 8000 server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) server_socket.bind((SERVER_HOST, SERVER_PORT)) server_socket.listen(1) while True: client_connection, client_address = server_socket.accept() request = client_connection.recv(1024).decode() response = 'HTTP/1.0 200 OK\n\nIt works!' client_connection.sendall(response.encode()) client_connection.close() ``` Run the server in one peer (`python3 server.py` - assuming you saved the above example in a file named `server.py`) and reach it with a client / browser from the other peer: ``` $ curl --location 'http://172.27.0.4:8000/' It works! ``` ## Next Steps [WireGuard Interface Guide](/docs/network/wireguard-interfaces) outlines many use cases that may be valuable to you. --- ## Use Cases ### Peers Across Clouds > Source: https://developers.telnyx.com/docs/network/wireguard-interfaces/use-cases/multi-cloud.md A WireGuard Interface forwards traffic between its peers. Hosts in different clouds that join the same interface reach each other on the interface subnet, even when their cloud firewalls block all inbound traffic except SSH. The diagram shows an AWS EC2 instance (`172.27.0.2`) and a DigitalOcean Droplet (`172.27.0.3`), each allowing only inbound SSH from the internet. Both connect over WireGuard tunnels to one WireGuard Interface (`172.27.0.1`, endpoint `64.16.243.3:5107`) in `ashburn-va`. HTTP between the two peers goes via the interface at `172.27.0.1`. ## Setup 1. Create a WireGuard Interface and wait for `provisioned`, as in the [Quick Start](/docs/network/wireguard-interfaces/quick-start). 2. Create one peer for each host and load each configuration with [WireGuard on Linux](/docs/network/wireguard-peer-config/linux). Both configurations route `172.27.0.0/24` through the tunnel. 3. Leave inbound HTTP closed in both cloud firewalls. Each peer opens its tunnel to the interface endpoint, so WireGuard needs no inbound rule. ## Result Both instances run a web server and allow only inbound SSH, so neither answers from the internet: ```bash user@localhost ~ % ping 34.201.0.189 PING 34.201.0.189 (34.201.0.189): 56 data bytes Request timeout for icmp_seq 0 Request timeout for icmp_seq 1 ^C --- 34.201.0.189 ping statistics --- 3 packets transmitted, 0 packets received, 100.0% packet loss user@localhost ~ % curl 34.201.0.189 ^C ``` Over the interface subnet, each instance reaches the other. From the EC2 instance: ```bash ubuntu@ip-10-10-11-10:~$ curl 172.27.0.3 I am the Droplet Peer in DigitalOcean ``` From the Droplet: ```bash root@ubuntu-s-1vcpu-512mb-10gb-nyc1-01:~# curl 172.27.0.2 I am the EC2 Peer in AWS ``` Add more peers in other clouds or data centers the same way. Every peer on the interface reaches every other peer on `172.27.0.0/24`. --- ### SIP Over WireGuard > Source: https://developers.telnyx.com/docs/network/wireguard-interfaces/use-cases/sip.md With `enable_sip_trunking` set to `true`, a WireGuard Interface carries its peers' SIP traffic to Telnyx inside the tunnel. The peer configuration adds the Telnyx SIP prefixes to `AllowedIPs`, so traffic to `sip.telnyx.com` and `sip.telnyx.eu` goes via the interface instead of the peer's default route. The diagram shows a PBX or SIP client at `172.27.0.2` sending SIP through its WireGuard tunnel to a WireGuard Interface at `172.27.0.1` created with `enable_sip_trunking` set to `true`. The interface forwards the SIP traffic across the Telnyx backbone to Telnyx SIP, including `sip.telnyx.com` and `sip.telnyx.eu`. Without the flag, the peer's SIP traffic goes via its default route. ## Setup 1. Create the interface with `enable_sip_trunking` set to `true`. Interfaces have no update operation, so set the flag at creation: ```json { "network_id": "91446ee3-9f6a-49ed-8d9b-1bd3e1529324", "name": "wg-sip-ashburn", "region_code": "ashburn-va", "enable_sip_trunking": true } ``` 2. Wait for `provisioned`, create a peer, and retrieve its configuration, as in the [Quick Start](/docs/network/wireguard-interfaces/quick-start). `AllowedIPs` now lists the Telnyx SIP prefixes after the interface subnet: ```ini [Peer] PublicKey = jSSaLXXVEzYUM8N8IM+65YuuScL+Sf2DytZCdLhFSGo= AllowedIPs = 172.27.0.0/24, 192.76.120.10/32, 185.246.41.140/32, ... Endpoint = 64.16.243.15:5016 PersistentKeepalive = 1 ``` The list above is abbreviated. Load the configuration as returned. ## Verify The first hop to `sip.telnyx.com` is the interface address: ```bash user@localhost ~ % traceroute sip.telnyx.com traceroute to sip.telnyx.com (192.76.120.10), 64 hops max, 40 byte packets 1 172.27.0.1 (172.27.0.1) 6.708 ms 7.726 ms 7.133 ms ``` --- ## API Reference (WireGuard Interfaces) ### WireGuard Interfaces - [List all WireGuard Interfaces](https://developers.telnyx.com/api-reference/wireguard-interfaces/list-all-wireguard-interfaces.md): Returns a paginated list of the WireGuard interfaces on your account, with support for filtering. - [Create a WireGuard Interface](https://developers.telnyx.com/api-reference/wireguard-interfaces/create-a-wireguard-interface.md): Create a new WireGuard Interface. Current limitation of 10 interfaces per user can be created. - [Retrieve a WireGuard Interfaces](https://developers.telnyx.com/api-reference/wireguard-interfaces/retrieve-a-wireguard-interfaces.md): Returns the details of a single WireGuard interface by its identifier. - [Delete a WireGuard Interface](https://developers.telnyx.com/api-reference/wireguard-interfaces/delete-a-wireguard-interface.md): Deletes the specified WireGuard interface from its network. - [List all WireGuard Peers](https://developers.telnyx.com/api-reference/wireguard-interfaces/list-all-wireguard-peers.md): Returns a paginated list of your WireGuard peers, with support for filtering. - [Create a WireGuard Peer](https://developers.telnyx.com/api-reference/wireguard-interfaces/create-a-wireguard-peer.md): Create a new WireGuard Peer. Current limitation of 5 peers per interface can be created. - [Retrieve the WireGuard Peer](https://developers.telnyx.com/api-reference/wireguard-interfaces/retrieve-the-wireguard-peer.md): Returns the details of a single WireGuard peer by its identifier. - [Update the WireGuard Peer](https://developers.telnyx.com/api-reference/wireguard-interfaces/update-the-wireguard-peer.md): Updates the specified WireGuard peer and returns the updated peer. - [Delete the WireGuard Peer](https://developers.telnyx.com/api-reference/wireguard-interfaces/delete-the-wireguard-peer.md): Deletes the specified WireGuard peer from its interface. - [Retrieve Wireguard config template for Peer](https://developers.telnyx.com/api-reference/wireguard-interfaces/retrieve-wireguard-config-template-for-peer.md): Retrieve Wireguard config template for Peer