WireGuard Hub-Spoke Key Checks for Multi-Server

For a hub-and-spoke WireGuard setup with multiple servers, the key check is simple: every peer (spoke) must have a unique private key and the hub’s public key, while the hub must have each spoke’s public key and a unique internal IP for each. You verify this by comparing the public keys on each side and confirming that the allowed IPs on the hub match the spoke’s tunnel IP exactly.

Background: Why Hub-and-Spoke?

WireGuard is a modern VPN protocol that uses cryptographic keys instead of usernames and passwords. In a hub-and-spoke topology, all traffic flows through a central server (the hub) to reach other spokes or the internet. This is common when you want a single point of control, simplified firewall rules, or centralized logging. Unlike a mesh, where every node connects directly to every other, hub-and-spoke reduces the number of tunnels from N(N-1)/2 to N-1, which is easier to manage for 10+ servers.

The trade-off is that all traffic traverses the hub, adding latency and a potential bottleneck. But for many multi-server setups—like a company with branch offices or a homelab with remote nodes—the simplicity wins.

How WireGuard Key Pairs Work

Each WireGuard interface has a private key and a public key. The public key is derived from the private key using Curve25519. You never share the private key; the public key is what you put in the [Peer] section of another machine’s config. When two peers connect, they perform a handshake using these keys to establish an encrypted tunnel.

In a hub-and-spoke setup, the hub has one private key and lists each spoke as a peer with its public key. Each spoke has its own private key and lists the hub as a peer with the hub’s public key. The spoke does not need to know other spokes’ keys because it sends all traffic to the hub, which then forwards it.

Key Checks You Must Perform

Here is a checklist to verify your keys are correct across a multi-server hub-and-spoke deployment:

• Unique private keys: Every server (hub and each spoke) must have a distinct private key. Never reuse a private key across machines—if one is compromised, all tunnels using that key are exposed.
• Correct public key on the peer: On the hub, each [Peer] section must contain the exact public key of the corresponding spoke. A single typo will cause the handshake to fail. On each spoke, the [Peer] section must contain the hub’s public key.
• AllowedIPs match tunnel IPs: On the hub, for each spoke peer, set AllowedIPs to that spoke’s tunnel IP (e.g., 10.0.0.2/32). On the spoke, set AllowedIPs to the hub’s tunnel IP (e.g., 10.0.0.1/32) plus any subnets you want to route through the hub (e.g., 0.0.0.0/0 for full tunnel).
• No overlapping AllowedIPs: If two spokes have the same tunnel IP, the hub will not know where to send traffic. Each spoke must have a unique internal IP in the same subnet.
• Key format: Public keys are base64-encoded, 44 characters long, ending with an equals sign. Check that you copied the entire string.

Common Misconceptions and Mistakes

One frequent mistake is confusing the public key with the preshared key. WireGuard supports an optional preshared key (PSK) that adds an extra layer of symmetric encryption. The PSK must be identical on both peers, but it is not a substitute for the public key. Another mistake is using the same private key on multiple spokes—this breaks the uniqueness requirement and can cause routing chaos.

Another misconception: you don’t need to configure the hub to allow forwarding between spokes if you only want spoke-to-hub communication. But if spokes need to talk to each other, you must enable IP forwarding on the hub and add appropriate firewall rules (e.g., iptables MASQUERADE). The keys alone don’t control routing; the AllowedIPs and OS routing do.

How to Verify Keys Across Servers

To check that keys are correctly paired, use the wg command on each server. On the hub, run sudo wg show to list all peers and their public keys. On each spoke, run the same command to see the hub’s public key. Compare the output with your config files. You can also use wg pubkey to derive a public key from a private key file, which is useful for verifying that the key you put in the config matches the one on disk.

If a tunnel fails, check the kernel logs with dmesg | grep wireguard or journalctl -u wg-quick@wg0. Common errors include “Invalid handshake initiation” (key mismatch) and “No peer with matching key” (wrong public key).

Choosing Between Hub-and-Spoke and Mesh

For 2-5 servers, a full mesh is simpler because every node has a direct tunnel, and you don’t need a central relay. For 6 or more, hub-and-spoke reduces configuration complexity. But consider the traffic pattern: if most traffic is between spokes, a mesh will be faster. If most traffic is to the internet or a central service, hub-and-spoke is fine.

There’s also a hybrid approach: use hub-and-spoke for the core and add direct spoke-to-spoke tunnels for high-traffic pairs. This is more work but balances performance and manageability.

Security Considerations

WireGuard’s keys are strong, but the security of your setup depends on protecting private keys. Store them in files with 600 permissions and never commit them to version control. Rotate keys periodically by generating a new private key on a server and updating the public key on all peers—this requires a brief downtime.

Also, be aware that the hub sees all unencrypted traffic from spokes (since it decrypts and re-encrypts). If you need end-to-end encryption between spokes, use a mesh or add an application-layer encryption like TLS.

Frequently Asked Questions

Q: Can I use the same private key on two spokes?
No. Each WireGuard interface must have a unique private key. Reusing a key means both spokes share the same identity, and the hub cannot distinguish them. It also increases the blast radius if the key leaks.

Q: What happens if I put the wrong public key on the hub?
The handshake will fail, and the spoke will not connect. You’ll see errors like “Invalid handshake initiation” in the logs. Double-check the public key string, including the trailing equals sign.

Q: Do I need a preshared key for each peer?
No, it’s optional. But if you use one, it must be the same on both the hub and the spoke for that peer. It adds protection against quantum attacks and helps mitigate compromised keys.

Q: How do I add a new spoke to an existing hub?
Generate a new key pair on the spoke, add a [Peer] section on the hub with the spoke’s public key and a unique tunnel IP, then add a [Peer] section on the spoke with the hub’s public key and the hub’s tunnel IP. Restart WireGuard on both.

Q: Why does my spoke connect but can’t reach other spokes?
Check that IP forwarding is enabled on the hub (sysctl net.ipv4.ip_forward=1) and that firewall rules allow traffic from the tunnel interface. Also, ensure the hub’s AllowedIPs for each spoke includes the spoke’s tunnel IP, and the spoke’s AllowedIPs includes the destination subnet.

Q: Can I use a dynamic IP for the hub?
Yes, but you need a way for spokes to find the hub’s current IP. Use a dynamic DNS name in the Endpoint field, or use a tool like wg-dynamic. The keys remain the same; only the endpoint changes.

Related

• How to Fix Critical Error Occurred Valorant
• Samsung S6 Won’t Turn On? Fixes That Work
• Diablo Party Up: How to Invite Friends