WireGuard VPN

Configure the local router or firewall to connect to Complement over WireGuard. Start with the VPN Overview if the setup questions haven’t been answered yet.

Key Exchange and Config Sheet

Generate a WireGuard key pair on the local device and send Complement only the public key. The private key never leaves the local network. Complement then sends a config sheet with its endpoint hostname or IP, its public key, a preshared key, and the tunnel addresses for both sides. The preshared key is sent through a one-time secure link.

Configure the Device

Add a WireGuard interface with one peer for Complement:

Setting	Value
Interface address	Local tunnel address with prefix, such as 192.168.200.2/24
Peer public key	Complement public key
Preshared key	From the config sheet
Endpoint	Complement endpoint hostname or IP, port 51820 (UDP)
Allowed IPs	Complement tunnel address, such as 192.168.200.1/32
Persistent keepalive	25 seconds

The local side starts the connection, and the keepalive holds it open through NAT. No static public IP or inbound firewall rules are required. If the firewall restricts outbound traffic, allow UDP 51820 to the Complement endpoint.

Route only the Complement tunnel address through the WireGuard interface, then add firewall rules so it can reach only the hosts and ports provided to Complement.

Troubleshooting

Issue	Possible Cause	Solution
No handshake	Outbound UDP 51820 is blocked, or a key or endpoint is wrong	Allow outbound UDP 51820 to the Complement endpoint and check each value against the config sheet
Handshake works, then stops after a while	The keepalive is off, so a NAT device drops the idle connection	Set persistent keepalive to 25 seconds
Tunnel is up but a host doesn’t answer	A firewall rule is missing, the host’s own firewall blocks the port, or the host is outside the subnet provided to Complement	Allow the Complement tunnel address on that port, on the firewall and on the host, such as Windows Defender Firewall
Office internet slows down or breaks	The tunnel is routing all traffic	Route only the Complement tunnel address through the tunnel