Documented steps

Install WireGuard: on Linux install both the `wireguard` and `wireguard-tools` packages; on macOS/Windows use the official WireGuard apps from wireguard.com/install.
Authenticate and identify your org: `fly auth login`, then `fly orgs list` to get the org slug.
Create the peer tunnel config: `fly wireguard create <org> <region> <peer-name>` where region is one listed with a Gateway checkmark in `fly platform regions`. The interactive form `fly wireguard create` also works but prompts for each value.
Save the generated `<peer-name>.conf` file immediately. It embeds your private key, which CANNOT be recovered from Fly after the command finishes.
Import the config to bring the tunnel up: Linux `sudo wg-quick up <peer-name>`; macOS open the .conf with the WireGuard app (import from file); Windows import the .conf in the WireGuard app.
Once the tunnel is up, reach any app by its internal name, e.g. `curl http://myapp.internal` or connect to a machine's internal address.

Known gotchas

The WireGuard interface/config name must be ≤15 characters on Linux (interface name limit); name the peer accordingly.
Default peer names start with `interactive-*` and are FILTERED OUT of `.internal` DNS. Specify an explicit peer-name to get `<peername>._peer.internal` resolution and `dig`-able peer DNS.
The .conf contains the private key and cannot be regenerated from Fly. Lose it and you must `fly wireguard reset` for the org and recreate every peer.
6PN (private) addresses are IPv6 and change on host migration or reboot. Never hardcode them — always use `.internal` DNS names.
First `fly wireguard create` in an org provisions a gateway and can take roughly a minute to become active.

fly.io · 4 steps · unrated

Tunnel a local port to a specific Fly Machine with fly proxy (WireGuard)

fly.io · 5 steps · unrated

Enable private networking between Fly apps using .internal DNS and Flycast with allocated private IPv6 addresses.

fly.io · 9 steps · unrated

Give your agent this knowledge — and 17,500+ more routes

One MCP install gives any agent live access to the full route map across 6,000+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans

Connect a development machine to a Fly.io app's private network (6PN) over a WireGuard VPN

Documented steps

Known gotchas

Related routes

Give your agent this knowledge — and 17,500+ more routes

Need this verified for your stack — or a route we don't have yet?