Open WireGuard Endpoints

By Lee Harding | June 3, 2026 | 7 min read

Two caller capabilities are disposable successful UDP Gateway today. The first allows WireGuard Listeners to accept connections from immoderate customer without pre-registration — the aforesaid exemplary HTTPS uses for websites. The second allows Lambda destinations to beryllium invoked asynchronously, firing a packet into a long-running workflow without the Gateway waiting for a response. Together they unfastened up a people of public-facing, event-driven WireGuard services that antecedently required important civilization infrastructure to build.

WireGuard Open Endpoints

WireGuard Listeners person ever required each connecting customer to beryllium pre-registered: you database each peer's nationalist cardinal successful your CloudFormation template, and the Listener rejects immoderate handshake from an chartless key. That exemplary fits backstage services pinch a managed group of devices. But it creates a problem for thing that needs to beryllium accessible by a ample aliases chartless group of clients.

Consider a mobile app that generates a WireGuard keypair connected first launch. Or a fleet of devices provisioned connected request wherever cardinal cardinal guidance is operationally impractical. Or immoderate public-facing work wherever clients you've ne'er seen earlier request to connect. With the erstwhile model, each 1 of those clients required an out-of-band registration measurement and a CloudFormation update earlier it could complete a handshake. That's not a exemplary that scales to nationalist services.

The caller AllowUnknownPeers spot removes that restriction. Set it to true connected a WireGuard Listener and the Gateway will complete the handshake pinch immoderate valid WireGuard client, sloppy of whether its nationalist cardinal is listed. The relationship is still afloat encrypted — WireGuard's cryptographic properties don't change. The quality is simply that the Listener nary longer requires the cardinal to beryllium known successful advance.

The affinity to HTTPS is intentional. When you sojourn a website complete HTTPS, the server doesn't request to cognize who you are earlier establishing an encrypted connection. The TLS handshake completes, the channel is encrypted, and authentication (if it happens astatine all) is simply a abstracted interest astatine the exertion layer. Open WireGuard endpoints activity the aforesaid way: the carrier is encrypted, and personality tin beryllium handled by your Lambda aliases Step Functions destination nevertheless your exertion requires.

Adding a shared credential gate

Fully unfastened enrollment — accepting virtually immoderate WireGuard customer — is due for immoderate services. For others, you want the encryption and the unfastened handshake, but you besides want to forestall connections from clients that weren't issued credentials. The UnknownPeerPreSharedKey property provides a lightweight gross for precisely this case.

When UnknownPeerPreSharedKey is set, chartless peers must see that PSK successful their WireGuard configuration aliases the handshake fails. It's not per-device authentication — each client uses the aforesaid concealed — but it meaningfully restricts entree to clients that were issued the PSK. Think of it for illustration a shared API cardinal for transport-layer access: not beardown identity, but a real obstruction against arbitrary connections from clients who were ne'er fixed credentials.

Distributing the PSK to clients is your application's responsibility. Store it successful AWS Secrets Manager and reference it from your CloudFormation stack connected the infrastructure side; proviso it to devices during manufacturing aliases enrollment connected the customer side.

WireGuardListener: Type: Custom::ProxylityUdpGatewayListener Properties: ServiceToken: !FindInMap [ProxylityConfig, !Ref "AWS::Region", ServiceToken] ApiKey: !FindInMap [ProxylityConfig, Account, ApiKey] Protocols: - wg AllowUnknownPeers: true UnknownPeerPreSharedKey: !Sub "{{resolve:secretsmanager:${WireGuardPSK}:SecretString}}" Destinations: - Name: packet-handler DestinationArn: !GetAtt HandlerLambda.Arn Role: Arn: !GetAtt ProxylityRole.Arn

Named peers (listed successful the Peers array) are unaffected by AllowUnknownPeers and UnknownPeerPreSharedKey. They usage their ain per-peer SharedSecret as before. The 2 models tin coexist connected a azygous Listener: a fixed group of known devices pinch per-device PSKs, and an unfastened slot for move clients down a shared credential.

Lambda Async Invocation

Lambda destinations successful UDP Gateway person ever utilized synchronous RequestResponse invocation: the Gateway delivers a batch of packets, waits for the usability to complete, and uses the function's return worth to nonstop reply packets backmost to clients. That exemplary is the default to align pinch how UDP request/response patterns work.

But synchronous invocation becomes limiting for workloads wherever a function's occupation is to footwear off processing that outlives a azygous invocation. Lambda durable functions reside precisely this: using a checkpoint-and-replay mechanism, a durable usability tin execute for up to 1 year, automatically resuming aft failures without losing progress. The Event invocation type is the right transportation exemplary present — the Gateway fires the packet batch and moves connected while the durable execution continues independently.

The caller UseAsyncInvoke statement changes the invocation type to Lambda's Event mode. The Gateway delivers the packet batch and instantly receives an HTTP 202 Accepted without waiting for the usability to complete. No reply is sent to the UDP client. The usability runs to completion independently of the Gateway's petition lifecycle.

The superior usage lawsuit is triggering durable workloads. A usability invoked with UseAsyncInvoke receives the inbound packet batch, starts a durable execution (or dispatches to Step Functions if you for illustration that orchestration model), and returns immediately. The distant customer sent a UDP packet; a long-running, fault-tolerant workflow is now moving on its behalf, pinch checkpointed advancement and automatic betterment from failures — nary of which requires the Gateway to clasp a relationship open.

Destinations: - Name: workflow-trigger DestinationArn: !GetAtt WorkflowTriggerLambda.Arn Role: Arn: !GetAtt ProxylityRole.Arn Arguments: UseAsyncInvoke: "true"

A fewer things to support successful mind erstwhile utilizing async invocation:

• No replies: The function's return worth is discarded. If a packet needs a reply, async invocation is the incorrect instrumentality — usage modular synchronous invocation aliases consequence streaming instead.
• AWS retries connected failure: Lambda will automatically retry a grounded async invocation up to twice. Make judge your usability (and immoderate downstream workflow it starts) is idempotent, or configure a dead-letter queue to seizure failures without silent information loss.
• Mutual removal pinch streaming: UseAsyncInvoke and UseResponseStreaming cannot some beryllium existent connected the aforesaid destination — they represent other transportation models.

Putting them together

These 2 features are independent, but they harvester people for a circumstantial pattern: a public WireGuard endpoint that triggers a long-running backend workflow.

Imagine a instrumentality provisioning service. Devices are manufactured without pre-registered keys — they make a keypair connected first boot, link to the unfastened WireGuard Listener utilizing the shared PSK, and nonstop a provisioning petition packet. A Lambda usability receives the packet, starts a Step Functions authorities instrumentality that handles the afloat provisioning workflow — personality registration, certificate issuance, DynamoDB grounds creation, SNS notification — and returns. The authorities instrumentality runs for minutes aliases hours. The instrumentality receives nary contiguous reply; provisioning confirmation comes through a abstracted transmission erstwhile the workflow completes.

None of that requires managing a cardinal registry earlier devices ship. None of it requires the Gateway to clasp a relationship unfastened for the long of provisioning. It's a packet in, a workflow started, and nary infrastructure moving betwixt events.

The aforesaid shape applies to immoderate inbound-triggered workflow wherever the sender doesn't request an contiguous response, specified arsenic instrumentality commands that footwear disconnected multi-step validation earlier execution, and audit events that request durable processing guarantees crossed aggregate systems.

Getting started

Both features are disposable now crossed each regions wherever UDP Gateway is supported. Neither requires changes to existing Listeners aliases destinations — AllowUnknownPeers defaults to mendacious and existing peer-list behaviour is unchanged, and Lambda destinations continue to usage synchronous invocation unless UseAsyncInvoke is explicitly set.

For complete configuration details, spot the WireGuard Listeners documentation and the Lambda destination documentation. The full CloudFormation spot reference for AllowUnknownPeers and UnknownPeerPreSharedKey covers each options including mixing named and chartless peers connected the aforesaid Listener.