WireGuard
tunelly is a client. Paste a wg-quick file, a
wireguard:// link, or a subscription that includes
one. The app handshakes with that peer and carries packets through
it. We operate no servers and sell no access.
What a profile carries
- PrivateKey
- This device. Empty is an incomplete record, and import stops.
- PublicKey
- The peer. Also required.
- Endpoint
- Host and port. Default port is 51820 when a link omits one.
- PresharedKey
- Optional. Sent when the profile has one.
- AllowedIPs
- Treated as the traffic split, not as a second routing language. A profile that carries everything is left as one.
- DNS
- Resolvers named in the file are handed to the engine with the rest of the profile.
AmneziaWG
Extra fields on the interface — junk packet counts and the header sizes Amnezia adds — are passed through when the file has them. A file without those fields is plain WireGuard, which is also what an AmneziaWG peer accepts from a client that sends none. The fields themselves are on AmneziaWG on iOS.
What is not carried
Non-zero reserved bytes (the WARP shape) are refused. They go on the packet before this engine's handshake applies; a tunnel built without them would reach a peer listening for something else, and look like a peer that never answers. The app names the feature and stops.
A latency figure for WireGuard is the handshake, not a request through the tunnel. WireGuard has no request to make and no status to read back.
Putting it in the app
Paste the file or the link. The add screen reads a
.conf as a whole, not line by line.
How to add a configuration covers the
clipboard and a link that does not open the app.
The same engine also speaks VLESS and Hysteria2. If you do not have a configuration yet, where to get servers explains how one reaches you, without naming anyone to buy from.