WireGuard (Interfaces) page improvements

- Fixing named private key command, not working in the latest version of Vyos
(tested with 1.4-rolling-g7c82c5c7104-20220217). It needs to be the private key.
- Updating the public key in the example to match the private key example, as
generated in the previous section.
- Explaining the persistent-keepalive flag in the RoadWarrior section

1 files changed, 13 insertions, 6 deletions

diff --git a/docs/configuration/interfaces/wireguard.rst b/docs/configuration/interfaces/wireguard.rst
index 1c4b734c..50fffcf8 100644
--- a/docs/configuration/interfaces/wireguard.rst
+++ b/docs/configuration/interfaces/wireguard.rst
@@ -169,15 +169,17 @@ traffic.
    WireGuard peers. This a design decision. For more information please
    check the `WireGuard mailing list`_.
 
-.. cfgcmd:: set interfaces wireguard <interface> private-key <name>
+.. cfgcmd:: set interfaces wireguard <interface> private-key <private-key>
 
-  To use a named key on an interface, the option private-key needs to be set.
+  Associates the previously generated private key to a specific WireGuard
+  interface. The private key can be generate via the command
+  :opcmd:`generate pki wireguard key-pair`.
 
   .. code-block:: none
 
-    set interfaces wireguard wg01 private-key KP01
+    set interfaces wireguard wg01 private-key 'iJJyEARGK52Ls1GYRCcFvPuTj7WyWYDo//BknoDU0XY='
 
-  The command :opcmd:`show wireguard keypairs pubkey KP01` will then show the
+  The command :opcmd:`show interfaces wireguard wg01 public-key` will then show the
   public key, which needs to be shared with the peer.
 
 **remote side - commands**
@@ -189,7 +191,7 @@ traffic.
   set interfaces wireguard wg01 peer to-wg01 allowed-ips '192.168.1.0/24'
   set interfaces wireguard wg01 peer to-wg01 address '192.0.2.2'
   set interfaces wireguard wg01 peer to-wg01 port '51820'
-  set interfaces wireguard wg01 peer to-wg01 public-key 'u41jO3OF73Gq1WARMMFG7tOfk7+r8o8AzPxJ1FZRhzk='
+  set interfaces wireguard wg01 peer to-wg01 public-key 'EKY0dxRrSD98QHjfHOK13mZ5PJ7hnddRZt5woB3szyw='
   set interfaces wireguard wg01 port '51820'
 
   set protocols static route 192.168.1.0/24 interface wg01
@@ -262,7 +264,12 @@ With WireGuard, a Road Warrior VPN config is similar to a site-to-site
 VPN. It just lacks the ``address`` and ``port`` statements.
 
 In the following example, the IPs for the remote clients are defined in
-the peers. This allows the peers to interact with one another.
+the peers. This allows the peers to interact with one another. In
+comparison to the site-to-site example the ``persistent-keepalive``
+flag is set to 15 seconds to assure the connection is kept alive.
+This is mainly relevant if one of the peers is behind NAT and can't
+be connected to if the connection is lost. To be effective this
+value needs to be lower than the UDP timeout.
 
 .. code-block:: none