← Back to articles

Show HN: Wg-admin – web UI for an existing WireGuard host

2026-09-07 | original

read original get GL.iNet GL-MT3000 Beryl AX Travel Router → more articles

Why This Matters

WireGuard is widely used for self-hosted VPNs, but most management panels assume ownership of the tunnel and force admins to migrate their configs. wg-admin takes the opposite approach, layering a web UI on top of an existing /etc/wireguard setup and applying changes via wg syncconf so tunnels don't drop. That lowers the friction of day-to-day peer management for small teams and homelab operators who already trust their server config.

Key Takeaways

Reads and edits existing /etc/wireguard configs in place instead of replacing wg-quick, PostUp, or NAT rules.
Uses wg syncconf for non-disruptive changes, plus automatic config backups before writes.
Covers routine peer work — add/rename/rotate/remove, QR codes and client .conf downloads, live handshake and transfer stats.

Worth a Look

GL.iNet GL-MT3000 Beryl AX Travel Router — If you're running your own WireGuard host, this pocket-sized travel router pairs perfectly with it \and and server support built into its web admin. Drop in the client config (or scan the QR code wg-admin generates) and every device on the Wi-Fi rides your tunnel. Great for hotel Wi-Fi and remote work without reconfiguring each laptop and phone.

See GL.iNet GL-MT3000 Beryl AX Travel Router on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.

A focused web UI for a WireGuard host that is already running. It reads the files already in /etc/wireguard , lets you add and edit peers, and applies changes with wg syncconf so the interface does not bounce.

wg-admin does not install WireGuard, replace wg-quick , or rewrite your PostUp / NAT lines. It sits on top of the configuration you already have.

More screenshots

Why it exists

Most WireGuard admin panels want to own the tunnel: they generate a new config, take over wg-quick , and leave you to re-learn their layout. This one does the opposite.

Install it on a host that already has a working VPN. Existing [Interface] keys, routing hooks, and peers stay as they are. You get a password-protected UI for day-to-day peer work — names, client files, QR codes, handshakes — without replacing the server setup you already trust.

Features

Inherits live configs — every *.conf in /etc/wireguard is listed and managed in place

— every in is listed and managed in place Non-disruptive apply — writes the file, then wg syncconf when the interface is up (no bounce)

— writes the file, then when the interface is up (no bounce) Peer lifecycle — add, rename, edit, rotate keys, and remove peers

... continue reading

Explore topics: wireguard wg-admin web ui vpn wg syncconf