What it does
Freifunk Munich's wg-access-server combines a WireGuard server, web device management, user authentication and configurable isolation policies.
This maintained wg-access-server fork adds a management layer around WireGuard. The repository describes device enrollment by file or QR code, routed networks behind devices, client isolation and policies based on identity-provider information. Those are useful distinctions when a shared tunnel needs rules for different users.
Freifunk Munich explicitly identifies the unmaintained upstream and its own continuing fork. Use this maintained repository's documentation rather than an old tutorial pointing to the original project. Its MIT-licensed code also exposes optional per-device metrics, including owner, traffic and last-handshake information. The project warns that these reveal who uses the VPN and when, and that the metrics endpoint needs authentication or network protection when enabled. Preserve the server's private key when planning a persistent installation so enrolled devices can continue working.
Strengths
- Identity-based access policies
- Routed-network and isolation options
Best for
- Small deployments needing user-aware WireGuard enrollment