Drıftstack docs
Docs

wg0.conf not accepted (incomplete, bad PresharedKey, private endpoint)

You might be here because: “wireguard config won’t save” · “PresharedKey is not a 44-char base64 key” · “that is not a complete wg0.conf yet” · “private_key must be a valid WireGuard key” · “Driftstack can’t use this saved WireGuard config” · “endpoint must be host:port” · “address is required for wireguard” · “wireguard not working”

Short answer

Paste the whole wg0.conf into the WireGuard box (or upload the file); the app fills the keys, endpoint and allowed IPs from it. It is refused when a field does not match what the server needs — the message names the field and why, exactly as the server would.

Check first

  • Signed in and online? Proxies save to your account.
  • Read the exact refusal under the form — it names the line or field.

Likely causes and fixes

  1. “That is not a complete wg0.conf yet.” You typed a character or a fragment. A real config has [Interface]/[Peer] headers or a PrivateKey = line. Paste the full file. When editing, a saved config is kept until a complete one is pasted.
  2. private_key / peer_public_key “must be a valid WireGuard key (44 characters, base64)”. Copy the keys again without spaces or line breaks.
  3. “PresharedKey is not a 44-char base64 key — fix it or remove the line”. A malformed pre-shared key would be dropped and the tunnel would never connect, so it is refused up front. A well-formed one is accepted and used; a wrong but well-formed one cannot be detected here and shows up later as a tunnel that never connects.
  4. Address missing. The [Interface] Address line (e.g. 10.7.0.2/32) is required — without it the tunnel cannot come up.
  5. endpoint must be host:port (port 1-65535) or “The WireGuard endpoint must be a public internet address.” Fix the Endpoint line. A host name counts by the address it resolves to: a name that points at a private, loopback or link-local address is refused like the address itself.
  6. “The DNS address in this WireGuard config cannot be used: …” (or “None of the N DNS addresses … can be used”). The DNS line does not have to be public: the private resolver your provider gives you inside the tunnel (Mullvad 10.64.0.1, Proton 10.2.0.1, IVPN 172.16.0.1, an fd00:: address) is fine, and so is any address your AllowedIPs send through the tunnel, such as a provider address in 192.0.2.0/24. The sentence gives the reason for the address that cannot be used: a loopback address (127.0.0.1), a link-local or cloud-metadata address (169.254.169.254), a multicast address, an unspecified, class E or broadcast address, an IPv4 address written as ::ffff:a.b.c.d, a reserved range the tunnel does not carry, or an entry written as a name, with a port or in a numeric form instead of as a plain IP address. Enter the DNS address your VPN provider gives for the config and save again. When the line lists a usable address next to an unusable one, the config is saved with the usable one and a note says what was removed.
  7. “Driftstack sends all of the session’s traffic through the VPN, so AllowedIPs must include 0.0.0.0/0.” The conf is a split tunnel. Set AllowedIPs = 0.0.0.0/0 (adding , ::/0 is fine); 0.0.0.0/1, 128.0.0.0/1 also counts as the whole internet.
  8. “Write an IPv6 endpoint as [2001:db8::1]:51820.” An IPv6 Endpoint without brackets cannot be told apart from its port. Put the address in square brackets.
  9. “This conf has 2 [Peer] blocks; Driftstack uses one — keep only the peer with the Endpoint and AllowedIPs = 0.0.0.0/0.” Delete the other [Peer] sections and paste again.
  10. “MTU must be a whole number from 1280 to 1500” (or the same for PersistentKeepalive, 0 to 65535). Fix or remove the line. A valid MTU is saved, sent and used: the tunnel runs at that MTU, and the form says so.
  11. “This looks like an OpenVPN .ovpn — switch Type to OpenVPN.” You pasted an OpenVPN file into the WireGuard box. Change the proxy type to OpenVPN and paste it there.
  12. Opening a saved row says “Driftstack can’t use this saved WireGuard config — field: reason. Paste or upload a corrected wg0.conf above to replace it.” The row was saved under older rules; paste a corrected file.
  13. “This WireGuard config has no IPv4 Address. Add an IPv4 address; IPv6-only tunnels are not supported yet.” Every Address entry is IPv6 (such as fd00::2/128). The tunnel runs over IPv4, so the Address line needs an IPv4 entry too; most providers give one (Address = 10.7.0.2/32, fd00::2/128). Add it from your provider’s config and paste again.

If it still fails

Press Talk to a person in this chat (or open Help) and include the field name and the sentence shown — never the private key, pre-shared key or the file.