WireGuard monitoring
Modern kernel-level VPN, config-based — actively verified from ExitProbe's distributed edge probes.
About WireGuard
WireGuard is a modern, extremely fast VPN protocol built into the Linux kernel. It uses state-of-the-art cryptography (ChaCha20, Curve25519) and has a tiny codebase, which makes it both fast and easy to audit.
Because WireGuard is silent by design — it only speaks when there is traffic — a server can be completely broken while still accepting pings. That is exactly why passive monitoring misses WireGuard failures.
How ExitProbe tests it
- 1ExitProbe brings up the tunnel using your wg-quick configuration on a real edge probe.
- 2Waits for a successful handshake with your peer.
- 3Routes a real HTTP request through the tunnel interface and verifies the returned exit IP matches your server.
- 4Optionally runs a throughput test through the interface to catch degraded links that are up but slow.
Your credentials are stored encrypted (AES-256-GCM) and only decrypted in memory at check time on the probe running the test. They never appear in logs, API responses, or incident payloads.
Common questions
WireGuard peers do not respond to anything until a valid handshake completes. If the private key, peer key or allowed IPs changed on either side, the route may exist but no data can flow. ExitProbe detects this because its verification request through the tunnel never succeeds.
A standard wg-quick configuration including at least the [Interface] section with your private key and a [Peer] section with the peer public key and endpoint. Configs are encrypted with AES-256-GCM at rest.
Yes. Add each peer as its own monitor (or as separate protocols alongside others) and assign different probes to see how each path performs from different regions.
Monitor your WireGuard server today
Free plan included — real handshakes, exit IP verification, instant alerts.