/ 01 GETTING STARTED
Getting Started
MeshWG provides a hosted control plane for standard WireGuard, making it easy to build a zero-trust mesh network. The fastest way to begin is to Follow the MeshWG Quickstart.
Learn how MeshWG's managed WireGuard mesh VPN architecture works. Explore the standard WireGuard configuration, zero-trust policies, and end-to-end testing.
MeshWG provides a hosted control plane for standard WireGuard, making it easy to build a zero-trust mesh network. The fastest way to begin is to Follow the MeshWG Quickstart.
MeshWG keeps things simple. Here are the core principles that define how it works, and why it's different.
All overlay traffic between your machines is routed through a single managed hub — the one place where access rules are applied. Your machines don't need to discover each other directly; they reach the hub, and the hub decides who reaches whom.
Each organization is fully isolated from every other organization on the service. Other organizations cannot see or reach your machines, even if they happen to use overlapping private IP ranges.
When you set a policy to deny, packets are dropped before they ever reach the destination machine. There's no software agent on your devices to bypass and no race window — the rule applies the moment you save it.
The keys MeshWG holds on your behalf are encrypted at rest. The service cannot start at all if the unlock secret is missing. Per-machine private keys are shown to you once at creation and never persisted server-side.
MeshWG forwards your overlay traffic between your own machines only. There is no internet egress path through us — your devices continue to reach the internet through their own local network.
When you add a machine in the dashboard, MeshWG returns a wg-quick configuration that any WireGuard implementation accepts as-is. Below is the exact format.
[Interface] PrivateKey = <shown once at machine creation> Address = 10.100.0.2/16 MTU = 1420 [Peer] # MeshWG hub for "acme-networks" PublicKey = <your MeshWG hub public key> Endpoint = vpn.meshwg.com:51820 AllowedIPs = 10.100.0.0/16 PersistentKeepalive = 25
We keep it simple. No gimmicks, no magic. Here's what MeshWG doesn't do.
Before any release ships, an automated end-to-end test drives the live service the same way a customer would, and measures real packet behaviour — not just API responses. If anything on this page regresses, the deploy fails and the change doesn't go out.
Each test measures real packet behaviour and real handshakes — not just status codes — so the claims on this page stay true release after release. Want to see a recent test transcript? Email hello@meshwg.com and we'll share the latest run.
You can deploy MeshWG directly onto supported network edge devices for transparent site-to-site connectivity. View supported WireGuard routers and devices to find compatible hardware from TP-Link, MikroTik, Ubiquiti, and more.
If a machine cannot connect to your MeshWG network, verify the following configuration basics:
vpn.meshwg.com:51820). If your local network blocks outbound UDP on port 51820, the handshake will fail.AllowedIPs field in your configuration matches the overlay subnet assigned to your organization (e.g. 10.100.0.0/16).For more comprehensive diagnostic steps, read our guide on Why Your VPN Keeps Disconnecting, or dive into WireGuard NAT Traversal for complex Carrier-Grade NAT environments.