How do I generate a WireGuard config to access my Fly.io private network from my laptop?

WireGuard is the easiest way to drop your laptop directly onto your Fly.io private network, so you can hit fdaa: addresses, debug services, and SSH into Machines like you’re in the same data center. The good news: you don’t have to hand‑craft any WireGuard config—flyctl does the heavy lifting.

Quick Answer: Use flyctl wireguard create to generate a peer config, then import that file into your local WireGuard client. Once connected, your laptop gets a private fdaa: address and can reach your Fly.io apps over the private network.

---

The Quick Overview

• What It Is: A flyctl workflow that generates a WireGuard peer config for your laptop, so it can join your Fly.io private network.
• Who It Is For: Developers and operators who want secure, low‑friction access to private services, Machines, Sprites, and databases on Fly.io.
• Core Problem Solved: You need to securely reach Fly.io private IPs from your local machine without punching random firewall holes or exposing internal services to the public internet.

---

How It Works

Fly.io runs your apps on a private IPv6 network. Each organization gets a private network space and each app gets internal fdaa: addresses. WireGuard is the on‑ramp: you create a WireGuard peer for your laptop, get a config file, and bring up a tunnel. From then on, packets to Fly’s private network are routed through that encrypted tunnel instead of the public internet.

At a high level:

1. Create a WireGuard peer with flyctl:
   You use flyctl wireguard create to generate keys, assign an IP, and spit out a ready‑to‑use config file.

2. Import the config into your WireGuard client:
   You add the config to the WireGuard app on macOS, Linux, or Windows and activate the tunnel.

3. Use Fly’s private network like you’re inside it:
   Once connected, you can hit private addresses, run fly ssh console through the tunnel, and debug services without exposing them publicly.

---

How It Works, Step by Step

1. Prerequisites

You’ll need:

• A Fly.io account and at least one app deployed.
• flyctl installed and logged in:

fly auth login

• WireGuard client installed on your laptop:
  • macOS: App Store “WireGuard”
  • Windows: WireGuard for Windows
  • Linux: sudo apt install wireguard (or distro equivalent) and/or the GUI client

Make sure you know which Fly organization you want access to (run fly orgs list).

2. Generate the WireGuard config with flyctl

Run this from your laptop:

fly wireguard create \
  --org my-org-name \
  --name laptop-kc

What this does:

• Generates a WireGuard keypair for this peer.
• Allocates a private IPv6 address for your laptop inside your org’s network space.
• Builds a complete WireGuard config.
• Saves it to a file (by default something like laptop-kc.conf in your current directory).

You’ll see output similar to:

Creating WireGuard peer in org my-org-name
Peer name: laptop-kc
Config written to: laptop-kc.conf
Peer private IP: fdaa:0:1234:a7b:abcd:ef01:2345:6789

Keep that .conf file safe; it contains your private key.

3. Import the config into your WireGuard client

macOS / Windows GUI

1. Open the WireGuard app.
2. Click Import tunnel(s) from file….
3. Select laptop-kc.conf.
4. Give it a friendly name if prompted.
5. Toggle the switch to Activate the tunnel.

Linux (CLI)

If you’re using the WireGuard tools directly:

sudo wg-quick up ./laptop-kc.conf

To bring it down later:

sudo wg-quick down ./laptop-kc.conf

If you use a desktop WireGuard GUI on Linux, import the config like on macOS/Windows.

4. Verify that you’re on the Fly.io private network

Once the tunnel is up:

• Check the interface:

ip addr | grep wg

or

wg

You should see a wg0 (or similar) interface with the fdaa: address from the config.

• Ping a private Fly.io address (for example, your app’s private IP if you know it):

ping6 fdaa:0:1234:a7b:...   # replace with a real private IP

• fly ssh console should now be able to connect over the private network more reliably, and any internal services bound only to fdaa: addresses will be reachable if firewall rules allow.

---

Features & Benefits Breakdown

Core Feature	What It Does	Primary Benefit
flyctl wireguard create	Generates a full WireGuard peer config for your laptop	No manual keygen, IP allocation, or endpoint guessing
Private IPv6 addressing	Assigns your laptop an fdaa: address in your org’s net	Direct access to Fly.io private services with predictable IPs
Encrypted tunnel via WireGuard	Sends traffic over WireGuard between your laptop and Fly.io edge	Secure, low‑latency access without exposing internal apps

---

Ideal Use Cases

• Best for private service debugging:
  Because you can hit APIs, databases, and Machines over fdaa: addresses, test changes safely, and avoid making them public “just so you can curl them.”

• Best for secure admin access:
  Because it gives operators SSH and admin access into Fly.io environments via WireGuard, instead of juggling bastion hosts or public jump boxes.

---

Limitations & Considerations

• Per‑org scope:
  Your WireGuard peer is created against a specific Fly organization. If you work across multiple orgs, you may want separate peers/configs per org.

• Local routing conflicts:
  If you’ve got other IPv6 VPNs or funky local routes, they can collide with the WireGuard routes. If things look weird (traffic not going where you expect), check AllowedIPs in the config and your system’s routing table. You can narrow AllowedIPs to just the Fly private ranges if needed.

---

Pricing & Plans

WireGuard access itself doesn’t have a separate SKU. It’s part of how you reach your apps and Machines on Fly.io. You pay for:

• The compute and storage you actually run (Machines, Sprites, Postgres, Tigris).
• Network egress as documented in Fly’s pricing.

If you’re thinking in “plan” terms:

• Individual / small team: Best for developers who want quick, safe access to a few apps while paying only for the Machines and storage they actually use.
• Larger teams / enterprises: Best for orgs that want private network access with team‑wide SSO, SOC2 Type 2, and support SLAs, while still using the same WireGuard mechanism under the hood.

---

Frequently Asked Questions

Do I need to configure my own WireGuard server for Fly.io?

Short Answer: No. Fly.io provides the WireGuard endpoint; you just create a peer.

Details:
When you run fly wireguard create, Fly.io acts as the WireGuard “server” side. flyctl talks to the Fly API, allocates your peer’s private IP, and bakes the remote endpoint (Fly.io side) into the config file. Your laptop is the “client” peer that dials in. You don’t spin up your own WireGuard VM or manage a separate gateway app.

---

Can I revoke or rotate a WireGuard config if my laptop is lost?

Short Answer: Yes. Delete the peer and create a new one.

Details:
If the laptop-kc.conf file leaks or a machine is compromised, treat it like exposed SSH keys:

1. Use flyctl to list WireGuard peers for your org.
2. Remove the compromised peer (command naming may vary by flyctl version, but it’s typically fly wireguard list/fly wireguard remove or similar).
3. Run fly wireguard create again to generate a fresh config for your new laptop.
   Once removed, the old peer’s keys and IP stop working. Traffic from that config won’t be accepted by Fly.io.

---

Summary

To get your laptop onto your Fly.io private network, you don’t need to learn WireGuard crypto internals or juggle hand‑written configs. You:

1. Run fly wireguard create --org <org> --name <peer-name> to generate a config.
2. Import the .conf file into your WireGuard client.
3. Bring up the tunnel and start talking to fdaa: addresses like you’re inside the same private network as your Fly Machines and services.

The result is secure, encrypted access to your Fly.io workloads with minimal ceremony and no extra gateway infrastructure to babysit.

---

Next Step

Get Started