Last Edited: 10/7/2026
Contributors:
Amy Le
Esther Jang
Ted Matsumura
Download and install the Windows client: Installation - WireGuard
Click the small triangle beside “Add tunnel” in the bottom right corner of Wireguard.
Click “Add empty tunnel…”
This will open the Edit tunnel window.
At the top will be your Public Key, and in the main section will be [Interface] and your PrivateKey.
[Interface]
PrivateKey = XXXXX <keep this private>
Address = 172.16.38.XX/32 <get this IP address from the SCN Admin you’re working with>
DNS = 10.0.1.4
MTU = 1424
[Peer]
PublicKey = 9CNjjeDdo0fMAySFxJyIbg7DvryyLgKcbpxdDxCF/3A=
AllowedIPs = 10.10.0.0/24, 10.11.0.0/24, 172.16.0.0/16, 10.0.1.0/24
Endpoint = 23.146.168.194:13130
PersistentKeepalive = 25
Send your public key (in your own settings, not the one in the file above) to the SCN Admin you’re working with, and she will give you an IP to put under the [Interface] / Address block above. You should be able to click Activate your connection.
You can try pinging 172.16.38.1 to see if the connection works, and you should get ping responses.
If you don’t have homebrew installed on your device, install that first here: https://brew.sh/
Run the command brew install wireguard-tools in your terminal
Generate your public/private key with this command: wg genkey | tee privatekey | wg pubkey > publickey
You can view/copy your public key by typing cat publickey in the directory that you generated the key in. Send it to the SCN Admin you’re working with.
Download the wireguard application onto your computer here to manage your config
Get the template config file from the SCN Admin you’re working with (this file is actually the same as the Step 3 text in the Windows section above, so just grab that!). If it’s not already, rename it wg0.conf (needs to have the .conf at the end).
Paste your private key in the spot where it says “PrivateKey=”. You can get it the same way that you got your public key.
Paste the IP address you have been assigned into the “Address=” field.
Now you can activate wireguard!
Start at “Key Generation” here: https://www.wireguard.com/quickstart/#key-generation
Get the template config file from the SCN Admin you’re working with (this file is actually the same as the Step 3 text in the Windows section above, so just grab that!). If it’s not already, rename it wg0.conf (needs to have the .conf at the end) and make sure it is in your /etc/wireguard/ folder.
Paste your private key in the spot where it says “PrivateKey=”. You can get it the same way that you got your public key.
Paste the IP address you have been assigned into the “Address=” field.
Then you can use the systemd version of wg-quick to start a wg tunnel with the edited config file, as follows:
`sudo systemctl start wg-quick@wg0.service`
Or if you prefer, just run the tunnel by hand in the terminal and terminate it when finished:
wg-quick up /etc/wireguard/wg0.conf
Start at “Key Generation” here: https://www.wireguard.com/quickstart/#key-generation
Use the following template config file. If it’s not already, name it wg0.conf (needs to have the .conf at the end):
[Interface]
PrivateKey = XXXXXXX <keep this private>
Address = 172.16.36.XX/32 <get this IP address from the SCN Admin you’re working with>
DNS = 10.0.1.4
MTU = 1360
[Peer]
PublicKey = En96/m0HEzDT8gfh1ld8EFtQjF5qvcWxpTHio3BcDCI=
AllowedIPs = 10.10.0.0/24, 10.11.0.0/24, 172.16.0.0/16, 10.0.1.0/24
Endpoint = 23.146.168.194:13129
PersistentKeepalive = 25
Paste your private key in the spot where it says “PrivateKey=”. You can get it the same way that you got your public key.
Paste the IP address you have been assigned into the “Address=” field.
Then you can use the systemd version of wg-quick to start a wg tunnel with the edited config file, as follows:
`sudo systemctl start [wg-quick@wg0.service](mailto:wg-quick@wg0.service)`
You can try pinging 172.16.36.1 to see if the connection works, and you should get ping responses.