# WireGuard (/templates/wireguard)



[WireGuard](https://www.wireguard.com) is a fast, modern VPN. This template runs [wg-easy](https://github.com/wg-easy/wg-easy), which adds a web interface for creating clients and handing out their configuration.

Deploy it from the [template list](/templates#deploy-a-template). It takes a minute or two.

## What gets deployed [#what-gets-deployed]

<TemplateServices name="WireGuard" />

Keys and client configurations are kept on a volume mounted at `/etc/wireguard`.

## What you fill in [#what-you-fill-in]

<TemplateInputs name="WireGuard" />

## After it deploys [#after-it-deploys]

Open the **WireGuard** service and look at its variables. The username is in `INIT_USERNAME` (it is `admin`) and the generated password is in `INIT_PASSWORD`. Sign in with those at your domain.

Create a client, then scan its QR code with the WireGuard app on your phone, or download the configuration file for your computer.

## Good to know [#good-to-know]

* **The VPN uses its own UDP port**: Unbind picks a free port between 30000 and 32767 and the server address for you. Both are already inside the client configurations wg-easy generates. You can see them as `INIT_PORT` and `INIT_HOST` on the service.
* **Open the port**: if your server sits behind a firewall, allow incoming UDP on that port.
* **The domain is only for the web interface**: VPN traffic does not go through it.