I've read WireGuard specification, and it looks that it doesn't natively support any kind of user authentication (i.e. LDAP or something like that). Any client which has server's public key, and whose IP address is whitelisted in the server configuration, can connect.

Does anyone knows about any WireGuard extension / implementation which does provide user authentication feature?



Each side of the tunnel has own generated key and derived public key (defined as "peer" on other side of connection). To act as you are writing you would share the private key between the "clients" which is the worst case you can do (technically you can but I hope nobody would even think about that).

Let think about "client vs. server" roles.


  • own secret key
  • list of all possible peers / users
    • each client is represented by own peer definition on server side with relevant public key of the client


  • own secret key
  • one peer definition with the public key of the server

We can say that client is authenticated using one factor authentication and the authentication is realized using public key of the client.

  • Granting access to new client mean to add peer definition to server side (can be realize without restarting VPN / without breaking all current vpn sessions).
  • Revoking access for the current client mean removing peer definition on server side (again it can be done also without restarting VPN - closing all current sessions).

If I correctly understood your question this "feature" is present in wireguard out of the box without any needs of extensions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.