WireGuard

MeowX can use a WireGuard peer as an ordinary proxy node. The WireGuard tunnel runs inside MeowX: your proxy rules decide which connections go through it, exactly like any other node, and MeowX does not create a separate system VPN for it. This works with standard WireGuard servers and with services such as Cloudflare WARP that use the reserved bytes.

Nodes use the mihomo / Clash Meta config format (type: wireguard), single-peer form.

Minimal example

proxies:
  - name: wg-node
    type: wireguard
    server: 192.0.2.1
    port: 51820
    ip: 10.0.0.2
    private-key: <base64 client private key>
    public-key: <base64 server public key>

Full example

proxies:
  - name: wg-full
    type: wireguard
    server: example.com
    port: 51820
    ip: 172.16.0.2
    private-key: <base64 client private key>
    public-key: <base64 server public key>
    preshared-key: <base64 preshared key>
    reserved: [0, 0, 0]

Parameters

Field	Type	Required	Default	Description
name	string	Yes	—	Node name. Must be unique.
type	string	Yes	—	wireguard.
server	string	Yes	—	Peer endpoint: domain name or IPv4 address.
port	integer	Yes	—	Peer UDP port.
ip	string	Yes	—	Your interface address inside the tunnel. Must be a plain IPv4 address without a prefix length (172.16.0.2, not 172.16.0.2/32).
private-key	string	Yes	—	Your private key, base64.
public-key	string	Yes	—	The peer’s public key, base64.
preshared-key	string	No	none (all zeros)	Optional preshared key, base64.
reserved	list of 3 integers	No	[0, 0, 0]	The three reserved bytes in every WireGuard message. Needed by Cloudflare WARP; leave unset for normal servers. Values other than exactly three entries are treated as [0, 0, 0].

Ignored fields

• ipv6 — IPv6 inside the tunnel is not supported (see Limitations).
• mtu — accepted but has no effect.
• udp — UDP is always available, whatever this field says.
• peers, allowed-ips, persistent-keepalive, dns, remote-dns-resolve, amnezia-wg-option and other extended options.
• dialer-proxy — not supported, see below.

Caution

reserved must be written as a YAML list of three integers. The base64 string form (reserved: "AAAA") used by some tools is not accepted and makes the whole configuration fail to load.

How it behaves

• The WireGuard session is set up the first time a connection uses the node, then shared by all connections through that node. If it dies, the next connection sets up a new one.
• The handshake is retried up to five times (about 2 seconds each) before the connection fails.
• A keepalive is sent every 20 seconds.
• Domain names (including fake-IP destinations) are resolved on the device and the connection is sent through the tunnel to the resulting IP address.

UDP

UDP is always supported and is full-cone: a single UDP session can send to any number of destinations, and replies are delivered with their real source address. This works well for games and voice/video calls.

Chained proxies

dialer-proxy cannot be used on a WireGuard node: WireGuard runs over UDP and cannot be carried through a TCP proxy. A WireGuard node with dialer-proxy is skipped with a warning in the logs. A WireGuard node can still be the target of another node’s dialer-proxy — see Chained proxies.

Limitations

• IPv4 only inside the tunnel. Connections to IPv6 destinations through a WireGuard node fail.
• One peer per node. The multi-peer peers: form is not supported.

Validation

Problem	Result
private-key, public-key or ip missing or empty	The whole configuration fails to load.
ip has a prefix length or is not an IPv4 address	The node loads, but every connection through it fails.
A key is not valid base64	The node loads, but every connection through it fails.
dialer-proxy is set	Node is skipped with a warning in the logs.

See also

• Protocol overview
• Chained proxies