wireguard.md

wireguard

← index · diagnosed problems

wireguard — an endpoint (a tunnel interface, not a plain outbound), sing-box type wireguard. Also written as wg, awg, amneziawg. Accepted from: share link, sing-box JSON, WireGuard .conf, AmneziaWG .conf, Xray JSON.

_{Schema checked against core 1.14.3-lx.17 · the link fragment (#…) is the node label}

Field	Value
scheme	wireguard
singbox_type	wireguard
kind	endpoint
aliases	wg, awg, amneziawg
sources	uri, singbox, wgconf, amnezia, xray
Core the schema was checked against	1.14.3-lx.17
Protocol levels (node label, ascending)	awg, awg1.5, awg2, awg3, awg3.1
Field order	must not decrease: jmin, jmax; otherwise all of them are removed: fields_order_invalid
URI fragment	label

How to read this page

share link          mapper                node body              sanitizer            core config
wireguard://…?…     ──▶ link parameter   ──▶  sing-box JSON,    ──▶  checks each     ──▶  what sing-box
                     becomes a body         stored in state        body field's         is actually
                     field                                         value                started with

• Link parameters — the dictionary of the share link: every parameter this scheme understands, and the body field each one becomes.
• Body fields — the node body itself: the sing-box JSON kept in the launcher state. The rules here hold for every input alike — a share link, sing-box JSON, Xray JSON or a hand-filled form — because they are checked after the input has already become a body.
• Diagnosed problems — every warning code a node of this scheme can carry, and the field that raises it.
• Replacements — what is silently rewritten on the way in: other spellings of the same name, values normalized or substituted, and structural decisions the mapper takes before any value is judged.
• Degradation — the same rules grouped by outcome: what drops the node, what only drops a field, and what is merely worth knowing.

A bad value never breaks the whole config: the field is dropped, replaced or — at worst — the single node is. Each link parameter says which of the three happens to it, taken from the rule of the body field it maps to.

Link parameters

Everything a link of this scheme can carry. Maps to points at the body field the value lands in; If invalid is that field's own rule.

Common

• userinfo — Client private key.
  • Type: private_key — base64 of the 32-byte private key
  • Maps to: private_key
  • If invalid: node dropped → wg_key_invalid
• #fragment — The part after #: the name the node is shown under. It is not a body field — it is the node label.

Protocol-specific

• publickey — Peer public key.
  • Also spelled: public_key
  • Type: base64
  • Maps to: peers[].public_key
• privatekey — Client private key.
  • Supported by LxBox only
  • Also spelled: private_key
  • Type: base64
  • Maps to: private_key
  • If invalid: node dropped → wg_key_invalid
• address — Addresses assigned to the tunnel interface.
  • Type: list
  • Maps to: address
  • If invalid: removed → type_invalid
• allowedips — Networks routed into the peer.
  • Also spelled: allowed_ips
  • Type: list · Default: 0.0.0.0/0,::/0
  • Maps to: peers[].allowed_ips
• mtu — Tunnel MTU.
  • Type: int
  • Maps to: mtu
  • If invalid: removed → type_invalid · If absent: filled in with 1280 when any of jc, jmin, jmax is set (and 25 more) · Above 1280: replaced with 1280 when any of jc, jmin, jmax is set (and 25 more) → awg_mtu_clamped. From singbox: kept as written, with a note → awg_mtu_high
• keepalive — Persistent keep-alive interval.
  • Type: int
  • Maps to: peers[].persistent_keepalive_interval
• presharedkey — Pre-shared key of the peer.
  • Also spelled: preshared_key
  • Type: base64
  • Maps to: peers[].pre_shared_key
• reserved — Reserved bytes of the WireGuard header.
  • Also spelled: client_id
  • Type: string
  • Maps to: peers[].reserved
• listenport — Local UDP port the tunnel listens on.
  • Supported by the desktop launcher only
  • Type: int
  • Maps to: listen_port
  • If invalid: removed → type_invalid
• name — Node label shown to the user.
  • Supported by the desktop launcher only
  • Type: string · Default: singbox-wg0
• dns — DNS servers of the profile: the launcher does not write them into the body.
  • Supported by the desktop launcher only
  • Type: list
• jc — AmneziaWG obfuscation parameter jc.
  • Type: int
  • Maps to: jc
  • If invalid: removed → awg_header_invalid
• jmin — AmneziaWG obfuscation parameter jmin.
  • Type: int
  • Maps to: jmin
  • If invalid: removed → awg_header_invalid
• jmax — AmneziaWG obfuscation parameter jmax.
  • Type: int
  • Maps to: jmax
  • If invalid: removed → awg_header_invalid
• s1 — AmneziaWG obfuscation parameter s1.
  • Type: int
  • Maps to: s1
  • If invalid: removed → awg_header_invalid
• s2 — AmneziaWG obfuscation parameter s2.
  • Type: int
  • Maps to: s2
  • If invalid: removed → awg_header_invalid
• s3 — AmneziaWG obfuscation parameter s3.
  • Type: int
  • Maps to: s3
  • If invalid: removed → awg3_field_invalid
• s4 — AmneziaWG obfuscation parameter s4.
  • Type: int
  • Maps to: s4
  • If invalid: removed → awg3_field_invalid
• h1 — AmneziaWG magic header H1.
  • Type: int
  • Maps to: h1
  • If invalid: removed → awg_header_invalid
• h2 — AmneziaWG magic header H2.
  • Type: int
  • Maps to: h2
  • If invalid: removed → awg_header_invalid
• h3 — AmneziaWG magic header H3.
  • Type: int
  • Maps to: h3
  • If invalid: removed → awg_header_invalid
• h4 — AmneziaWG magic header H4.
  • Type: int
  • Maps to: h4
  • If invalid: removed → awg_header_invalid
• i1 — AmneziaWG 3.x junk packet I1.
  • Type: string
  • Maps to: i1
• i2 — AmneziaWG 3.x junk packet I2.
  • Type: string
  • Maps to: i2
• i3 — AmneziaWG 3.x junk packet I3.
  • Type: string
  • Maps to: i3
• i4 — AmneziaWG 3.x junk packet I4.
  • Type: string
  • Maps to: i4
• i5 — AmneziaWG 3.x junk packet I5.
  • Type: string
  • Maps to: i5
• id — AmneziaWG 3.x cover protocol domain.
  • Type: string
  • Maps to: id
  • If invalid: removed → awg3_field_invalid
• ip — AmneziaWG 3.x cover protocol.
  • Type: string
  • Maps to: ip
  • If invalid: removed → awg3_field_invalid
• ib — AmneziaWG 3.x browser signature.
  • Type: string
  • Maps to: ib
  • If invalid: removed → awg3_field_invalid

Body fields

The node body itself — the sing-box JSON kept in the launcher state. The path is the one used in that body, and the rules below apply to every input alike: a share link, sing-box JSON, Xray JSON or a hand-filled form.

• system — Use a system interface instead of the userspace stack.
  • Type: bool
  • Default: false
• name — Interface name when a system interface is used.
  • Type: string
• mtu — Tunnel MTU in bytes.
  • Type: int, 576–1500
  • Default: 1408
  • Set by link parameter: mtu
  • If invalid: removed → type_invalid
  • If absent: filled in with 1280 when any of jc, jmin, jmax is set (and 25 more)
  • Above 1280: replaced with 1280 when any of jc, jmin, jmax is set (and 25 more) → awg_mtu_clamped. From singbox: kept as written, with a note → awg_mtu_high
  • Form: block advanced
• address — Addresses assigned to the tunnel interface.
  • Type: string_array, format cidr, normalized: cidr_prefix
  • Required: the node is dropped without it
  • Set by link parameter: address
  • If invalid: removed → type_invalid
  • Form: block connection, required
• private_key — Local private key.
  • Type: string, secret, role private_key, format base64_32, normalized: base64_std
  • Required: the node is dropped without it
  • Set by link parameter: userinfo, privatekey
  • If invalid: node dropped → wg_key_invalid
  • Form: block connection, required
• listen_port — Local UDP port the tunnel listens on.
  • Type: uint16, format port, 1–65535
  • Set by link parameter: listenport
  • If invalid: removed → type_invalid
  • Conflicts with: detour
• peers — List of WireGuard peers.
  • Type: array
  • Required: the node is dropped without it
  • Form: block connection
• peers.address — Peer endpoint address.
  • Type: string, format host
  • Required: the node is dropped without it
  • If invalid: node dropped → field_missing
  • Form: block connection, required
• peers.port — Peer endpoint port.
  • Type: uint16, format port, 1–65535
  • Required: the node is dropped without it
  • If invalid: node dropped → port_invalid
  • Form: block connection, required
• peers.public_key — Peer public key.
  • Type: string, format base64_32, normalized: base64_std
  • Required: the node is dropped without it
  • If invalid: node dropped → wg_key_invalid
  • Form: block connection, required
• peers.pre_shared_key — Optional pre-shared key.
  • Type: string, secret, format base64_32, normalized: base64_std
  • If invalid: node dropped → wg_key_invalid
  • Form: block advanced
• peers.allowed_ips — Prefixes routed to this peer.
  • Type: string_array, format cidr, normalized: cidr_prefix
  • Required: the node is dropped without it
  • If invalid: removed → type_invalid
  • If absent: filled in with 0.0.0.0/0, ::/0
  • Form: block advanced
• peers.persistent_keepalive_interval — Keepalive interval in seconds, number or range.
  • Type: awg_range
  • Range form N-M needs core ≥ 1.14.0-lx.32, build tag with_awg; means level awg3; on a core that lacks it the whole node is dropped at build: awg3_core_unsupported; removing the extension collapses the range to its lower bound
  • Form: block advanced
• peers.reserved — Three reserved bytes prepended to packets.
  • Type: int_array, 0–255, len 3
  • If invalid: removed → type_invalid
• udp_timeout — Idle timeout of a UDP session.
  • Type: duration
• udp_mapping — UDP NAT mapping behaviour.
  • Type: string
• udp_filtering — UDP NAT filtering behaviour.
  • Type: string
• udp_nat_max — Maximum number of UDP NAT entries.
  • Type: int, 0–…
  • If invalid: removed → type_invalid
• workers — Number of packet processing workers.
  • Type: int, 0–…
  • If invalid: removed → type_invalid
• jc — Number of junk packets sent before the handshake.
  • Type: int, 0–…
  • Set by link parameter: jc
  • If invalid: removed → awg_header_invalid
  • Only written when: core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
  • Means protocol level awg
  • Form: block amnezia
• jmin — Minimum size of a junk packet.
  • Type: int, 0–…
  • Set by link parameter: jmin
  • If invalid: removed → awg_header_invalid
  • Meaningless without: jmax
  • Only written when: core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
  • Means protocol level awg
  • Form: block amnezia
• jmax — Maximum size of a junk packet.
  • Type: int, 0–…
  • Set by link parameter: jmax
  • If invalid: removed → awg_header_invalid
  • Only written when: core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
  • Means protocol level awg
  • Form: block amnezia
• s1 — Junk prepended to the handshake initiation packet.
  • Type: int, 0–…
  • Set by link parameter: s1
  • If invalid: removed → awg_header_invalid
  • Only written when: core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
  • Means protocol level awg
  • Form: block amnezia
• s2 — Junk prepended to the handshake response packet.
  • Type: int, 0–…
  • Set by link parameter: s2
  • If invalid: removed → awg_header_invalid
  • Only written when: core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
  • Means protocol level awg
  • Form: block amnezia
• s3 — Junk prepended to the cookie reply packet.
  • Type: int, 0–…
  • Set by link parameter: s3
  • If invalid: removed → awg3_field_invalid
  • Only written when: core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
  • Means protocol level awg2
  • Form: block amnezia
• s4 — Junk prepended to every transport packet.
  • Type: int, 0–…
  • Set by link parameter: s4
  • If invalid: removed → awg3_field_invalid
  • Only written when: core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
  • Means protocol level awg2
  • Form: block amnezia
• h1 — Magic header of the handshake initiation packet.
  • Type: awg_range, normalized: range_order
  • Set by link parameter: h1
  • If invalid: removed → awg_header_invalid
  • Only written when: core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
  • Range form N-M; means level awg2
  • Means protocol level awg
  • Form: block amnezia
• h2 — Magic header of the handshake response packet.
  • Type: awg_range, normalized: range_order
  • Set by link parameter: h2
  • If invalid: removed → awg_header_invalid
  • Only written when: core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
  • Range form N-M; means level awg2
  • Means protocol level awg
  • Form: block amnezia
• h3 — Magic header of the cookie reply packet.
  • Type: awg_range, normalized: range_order
  • Set by link parameter: h3
  • If invalid: removed → awg_header_invalid
  • Only written when: core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
  • Range form N-M; means level awg2
  • Means protocol level awg
  • Form: block amnezia
• h4 — Magic header of the transport packet.
  • Type: awg_range, normalized: range_order
  • Set by link parameter: h4
  • If invalid: removed → awg_header_invalid
  • Only written when: core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
  • Range form N-M; means level awg2
  • Means protocol level awg
  • Form: block amnezia
• i1 — First custom junk packet.
  • Type: string
  • Set by link parameter: i1
  • Conflicts with: id
  • Conflicts with: ip
  • Conflicts with: ib
  • Only written when: core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
  • Means protocol level awg1.5
  • Form: block amnezia
• i2 — Second custom junk packet.
  • Type: string
  • Set by link parameter: i2
  • Conflicts with: ip
  • Only written when: core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
  • Means protocol level awg1.5
  • Form: block amnezia
• i3 — Third custom junk packet.
  • Type: string
  • Set by link parameter: i3
  • Only written when: core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
  • Means protocol level awg1.5
  • Form: block amnezia
• i4 — Fourth custom junk packet.
  • Type: string
  • Set by link parameter: i4
  • Only written when: core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
  • Means protocol level awg1.5
  • Form: block amnezia
• i5 — Fifth custom junk packet.
  • Type: string
  • Set by link parameter: i5
  • Only written when: core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
  • Means protocol level awg1.5
  • Form: block amnezia
• id — Masquerade domain name.
  • Type: string, format host, must match ^[A-Za-z0-9_](?:[A-Za-z0-9_-]{0,61}[A-Za-z0-9_])?(?:\.[A-Za-z0-9_](?:[A-Za-z0-9_-]{0,61}[A-Za-z0-9_])?)*\.?$, …–253
  • Set by link parameter: id
  • If invalid: removed → awg3_field_invalid
  • Meaningless without: ip
  • Only written when: core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
  • Means protocol level awg1.5, adds + to the level label
• ip — Protocol the traffic is masqueraded as.
  • Type: enum, "", quic, dns, stun, sip, normalized: trim_lower
  • Set by link parameter: ip
  • If invalid: removed → awg3_field_invalid
  • Meaningless without: id when ip is quic
  • Only written when: core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
  • Means protocol level awg1.5, adds + to the level label
• ib — Client profile imitated inside the masquerade.
  • Type: enum, "", chrome, firefox, curl, normalized: trim_lower
  • Set by link parameter: ib
  • If invalid: removed → awg3_field_invalid
  • Meaningless without: ip
  • Only written when: core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
  • Means protocol level awg1.5, adds + to the level label
• header_protection_key — Key protecting packet headers.
  • Type: string, secret, format base64_32, must match ^$|^[A-Za-z0-9+/_-]*[B-Za-z0-9+/_-][A-Za-z0-9+/_-]*={0,2}$, normalized: base64_std
  • If invalid: node dropped → awg3_header_key_invalid
  • Only written when: core ≥ 1.14.0-lx.32, lx fork only, build tag with_awg
  • On a core that lacks it the whole node is dropped at build: awg3_core_unsupported
  • Means protocol level awg3
• content_padding_addition — Extra content padding, number or range.
  • Type: awg_range
  • If invalid: removed → awg3_field_invalid
  • Only written when: core ≥ 1.14.0-lx.32, lx fork only, build tag with_awg
  • On a core that lacks it the whole node is dropped at build: awg3_core_unsupported
  • Means protocol level awg3
• rekey_after_time — Rekey after this many seconds.
  • Type: awg_range
  • Default: 120
  • If invalid: removed → awg3_field_invalid
  • Only written when: core ≥ 1.14.0-lx.32, lx fork only, build tag with_awg
  • On a core that lacks it the whole node is dropped at build: awg3_core_unsupported
  • Means protocol level awg3
• rekey_timeout — Rekey attempt timeout in seconds.
  • Type: awg_range
  • Default: 5
  • If invalid: removed → awg3_field_invalid
  • Only written when: core ≥ 1.14.0-lx.32, lx fork only, build tag with_awg
  • On a core that lacks it the whole node is dropped at build: awg3_core_unsupported
  • Means protocol level awg3
• reject_after_time — Reject the session after this many seconds.
  • Type: awg_range
  • Default: 180
  • If invalid: removed → awg3_field_invalid
  • Only written when: core ≥ 1.14.0-lx.32, lx fork only, build tag with_awg
  • On a core that lacks it the whole node is dropped at build: awg3_core_unsupported
  • Means protocol level awg3
• keepalive_timeout — Keepalive timeout in seconds.
  • Type: awg_range
  • Default: 10
  • If invalid: removed → awg3_field_invalid
  • Only written when: core ≥ 1.14.0-lx.32, lx fork only, build tag with_awg
  • On a core that lacks it the whole node is dropped at build: awg3_core_unsupported
  • Means protocol level awg3
• max_handshake_attempts — Maximum handshake attempts, count not seconds.
  • Type: awg_range
  • Default: 18
  • If invalid: removed → awg3_field_invalid
  • Only written when: core ≥ 1.14.0-lx.32, lx fork only, build tag with_awg
  • On a core that lacks it the whole node is dropped at build: awg3_core_unsupported
  • Means protocol level awg3
• random_trailers — Append random trailing bytes to packets.
  • Type: bool
  • Default: false
  • If invalid: removed → awg3_field_invalid
  • Only written when: core ≥ 1.14.0-lx.32, lx fork only, build tag with_awg
  • On a core that lacks it the whole node is dropped at build: awg3_core_unsupported
  • Means protocol level awg3.1
• disable_cookies — Disable the cookie mechanism.
  • Type: bool
  • Default: false
  • If invalid: removed → awg3_field_invalid
  • Only written when: core ≥ 1.14.0-lx.32, lx fork only, build tag with_awg
  • On a core that lacks it the whole node is dropped at build: awg3_core_unsupported
  • Means protocol level awg3.1
• detour — Tag of the outbound this connection is routed through.
  • Type: string, set by config build
• bind_interface — Network interface the connection is bound to.
  • Type: string
• inet4_bind_address — Local IPv4 address to bind to.
  • Type: string, format ipv4
  • If invalid: removed → type_invalid
• inet6_bind_address — Local IPv6 address to bind to.
  • Type: string
• connect_timeout — Timeout for establishing the connection.
  • Type: duration
• tcp_fast_open — Use TCP Fast Open.
  • Type: bool
  • Default: false
• disable_tcp_keep_alive — Disable TCP keepalive on this connection.
  • Type: bool
  • Default: false
• tcp_keep_alive — Idle time before the first TCP keepalive probe.
  • Type: duration, normalized: duration_bare_seconds
• tcp_keep_alive_interval — Interval between TCP keepalive probes.
  • Type: duration, normalized: duration_bare_seconds
• udp_fragment — Allow fragmenting UDP packets.
  • Type: bool, tristate
• domain_resolver — DNS server tag used to resolve the server domain.
  • Type: string
• network_strategy — Strategy for picking the outbound network interface. The core judges the value: the launcher passes it through unchecked.
  • Type: string
• network_type — Interface types allowed for this connection. The core judges the values.
  • Type: listable_string
• fallback_network_type — Interface types used when the primary ones are unavailable. The core judges the values.
  • Type: listable_string
• fallback_delay — Delay before falling back to the secondary network type.
  • Type: duration

Form layout

Read by the node forms only; the sanitizer ignores it. A hidden field stays in the body as written.

• Blocks: connection, amnezia, advanced

Diagnosed problems

Every code that can be raised on a node of this scheme, including the ones coming from the shared TLS, transport, multiplex and dialer sub-schemas. Follow a code for what it means and what to do about it.

• awg3_field_invalid
  • s3 — the value does not fit the field → removed
  • s4 — the value does not fit the field → removed
  • id — the value does not fit the field → removed
  • ip — the value does not fit the field → removed
  • ib — the value does not fit the field → removed
  • content_padding_addition — the value does not fit the field → removed
  • rekey_after_time — the value does not fit the field → removed
  • rekey_timeout — the value does not fit the field → removed
  • reject_after_time — the value does not fit the field → removed
  • keepalive_timeout — the value does not fit the field → removed
  • max_handshake_attempts — the value does not fit the field → removed
  • random_trailers — the value does not fit the field → removed
  • disable_cookies — the value does not fit the field → removed
• awg3_header_key_invalid
  • header_protection_key — the value does not fit the field → node dropped
• awg_header_invalid
  • jc — the value does not fit the field → removed
  • jmin — the value does not fit the field → removed
  • jmin — set without jmax → removed
  • jmax — the value does not fit the field → removed
  • s1 — the value does not fit the field → removed
  • s2 — the value does not fit the field → removed
  • h1 — the value does not fit the field → removed
  • h2 — the value does not fit the field → removed
  • h3 — the value does not fit the field → removed
  • h4 — the value does not fit the field → removed
• awg_mtu_clamped
  • mtu — the value is above 1280 when any of jc, jmin, jmax is set (and 25 more) → replaced with 1280
• awg_mtu_high
  • mtu — the value is above 1280 when any of jc, jmin, jmax is set (and 25 more), but the body came from singbox → kept with a notice
• detour_with_listen_port
  • listen_port — conflicts with detour → removed
• field_conflict
  • i1 — conflicts with id → removed
  • i1 — conflicts with ip → removed
  • i1 — conflicts with ib → removed
  • i2 — conflicts with ip → removed
• field_missing
  • peers — required and missing → node dropped
  • peers.address — the value does not fit the field → node dropped
• field_requires
  • id — set without ip → removed
  • ip — set without id when ip is quic → removed
  • ib — set without ip → removed
• port_invalid
  • peers.port — the value does not fit the field → node dropped
• type_invalid
  • mtu — the value does not fit the field → removed
  • address — the value does not fit the field → removed
  • listen_port — the value does not fit the field → removed
  • peers.allowed_ips — the value does not fit the field → removed
  • peers.reserved — the value does not fit the field → removed
  • udp_nat_max — the value does not fit the field → removed
  • workers — the value does not fit the field → removed
  • inet4_bind_address — the value does not fit the field → removed
• wg_key_invalid
  • private_key — the value does not fit the field → node dropped
  • peers.public_key — the value does not fit the field → node dropped
  • peers.pre_shared_key — the value does not fit the field → node dropped

Replacements

Link parameter names. The same parameter is spelled differently by different clients; the left spelling is read as the right one.

• public_key → publickey
• private_key → privatekey
• allowed_ips → allowedips
• preshared_key → presharedkey
• client_id → reserved

Values. What the sanitizer does to a value before it reaches the node body.

• mtu — when absent, filled in with 1280 when any of jc, jmin, jmax is set (and 25 more)
• mtu — above 1280: replaced with 1280 when any of jc, jmin, jmax is set (and 25 more) → awg_mtu_clamped. From singbox: kept as written, with a note → awg_mtu_high
• address — normalized: cidr_prefix
• private_key — normalized: base64_std
• peers.public_key — normalized: base64_std
• peers.pre_shared_key — normalized: base64_std
• peers.allowed_ips — normalized: cidr_prefix
• peers.allowed_ips — when absent, filled in with 0.0.0.0/0, ::/0
• h1 — normalized: range_order
• h2 — normalized: range_order
• h3 — normalized: range_order
• h4 — normalized: range_order
• ip — normalized: trim_lower
• ib — normalized: trim_lower
• header_protection_key — normalized: base64_std
• tcp_keep_alive — normalized: duration_bare_seconds
• tcp_keep_alive_interval — normalized: duration_bare_seconds

Structural translations. Decisions taken while the link is being read, before any value is judged: whether a block exists at all, where a field comes from, or how one input becomes several fields. The sanitizer sees a finished body and cannot take them.

• a WireGuard key written url-safe or without padding (a-b_c…, 43 chars) → the same 32 bytes as std base64 with padding (44 chars) — Panels write the same key in all four base64 spellings; the core decodes these fields with std base64 only.
  • Kind: spelling
• a bare IP in address or allowed_ips (10.0.0.2, fd00::2) → 10.0.0.2/32, fd00::2/128 — wg-quick config files write single addresses without a prefix length; the core field is a CIDR.
  • Kind: spelling

Degradation

The node is dropped

• header_protection_key — invalid value
• peers.address — invalid value
• peers.port — invalid value
• peers.pre_shared_key — invalid value
• peers.public_key — invalid value
• peers — required and missing
• private_key — invalid value

The field is removed, the node lives on

• address — invalid value
• content_padding_addition — invalid value
• disable_cookies — invalid value
• h1 — invalid value
• h2 — invalid value
• h3 — invalid value
• h4 — invalid value
• i1 — conflicts with another field of the same node
• i2 — conflicts with another field of the same node
• ib — conflicts with another field of the same node
• ib — invalid value
• id — conflicts with another field of the same node
• id — invalid value
• inet4_bind_address — invalid value
• ip — conflicts with another field of the same node
• ip — invalid value
• jc — invalid value
• jmax — invalid value
• jmin — conflicts with another field of the same node
• jmin — invalid value
• keepalive_timeout — invalid value
• listen_port — conflicts with another field of the same node
• listen_port — invalid value
• max_handshake_attempts — invalid value
• mtu — invalid value
• peers.allowed_ips — invalid value
• peers.reserved — invalid value
• random_trailers — invalid value
• reject_after_time — invalid value
• rekey_after_time — invalid value
• rekey_timeout — invalid value
• s1 — invalid value
• s2 — invalid value
• s3 — invalid value
• s4 — invalid value
• udp_nat_max — invalid value
• workers — invalid value

The value is replaced, the node lives on

• mtu — a value above 1280 is replaced with 1280 when any of jc, jmin, jmax is set (and 25 more)
• mtu — absent value is filled in with 1280 when any of jc, jmin, jmax is set (and 25 more)
• peers.allowed_ips — absent value is filled in with 0.0.0.0/0, ::/0

Kept as is, with a notice

• mtu — a value above 1280 coming from singbox is kept, with a note

Left out when the running core is too old

• content_padding_addition — needs core ≥ 1.14.0-lx.32, lx fork only, build tag with_awg
• content_padding_addition — on a core that lacks it the whole node is dropped (awg3_core_unsupported)
• disable_cookies — needs core ≥ 1.14.0-lx.32, lx fork only, build tag with_awg
• disable_cookies — on a core that lacks it the whole node is dropped (awg3_core_unsupported)
• h1 — needs core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
• h2 — needs core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
• h3 — needs core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
• h4 — needs core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
• header_protection_key — needs core ≥ 1.14.0-lx.32, lx fork only, build tag with_awg
• header_protection_key — on a core that lacks it the whole node is dropped (awg3_core_unsupported)
• i1 — needs core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
• i2 — needs core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
• i3 — needs core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
• i4 — needs core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
• i5 — needs core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
• ib — needs core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
• id — needs core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
• ip — needs core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
• jc — needs core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
• jmax — needs core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
• jmin — needs core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
• keepalive_timeout — needs core ≥ 1.14.0-lx.32, lx fork only, build tag with_awg
• keepalive_timeout — on a core that lacks it the whole node is dropped (awg3_core_unsupported)
• max_handshake_attempts — needs core ≥ 1.14.0-lx.32, lx fork only, build tag with_awg
• max_handshake_attempts — on a core that lacks it the whole node is dropped (awg3_core_unsupported)
• peers.persistent_keepalive_interval as a range N-M — on a core that lacks it the whole node is dropped (awg3_core_unsupported)
• random_trailers — needs core ≥ 1.14.0-lx.32, lx fork only, build tag with_awg
• random_trailers — on a core that lacks it the whole node is dropped (awg3_core_unsupported)
• reject_after_time — needs core ≥ 1.14.0-lx.32, lx fork only, build tag with_awg
• reject_after_time — on a core that lacks it the whole node is dropped (awg3_core_unsupported)
• rekey_after_time — needs core ≥ 1.14.0-lx.32, lx fork only, build tag with_awg
• rekey_after_time — on a core that lacks it the whole node is dropped (awg3_core_unsupported)
• rekey_timeout — needs core ≥ 1.14.0-lx.32, lx fork only, build tag with_awg
• rekey_timeout — on a core that lacks it the whole node is dropped (awg3_core_unsupported)
• s1 — needs core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
• s2 — needs core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
• s3 — needs core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg
• s4 — needs core ≥ 1.13.13-lx.1, lx fork only, build tag with_awg