Skip to main content

Wireguard OpenWrt

Introduction

I recently figured out how to set up a WireGuard VPN on my Raspberry Pi 3 running OpenWRT and I decided to write an up-to-date guide on how to do it. It should work on any device running a recent-ish build of OpenWRT/LEDE, provided you have enough storage space for it.

This will let you connect to your home network from anywhere, as well as route all your traffic through your home internet so you can avoid content filters at School/Work, as well as keeping your traffic encrypted.

I don't use IPv6 on my network so you'll have to figure that stuff out for yourself.

Before you begin, I'll warn you that the process of setting up WireGuard may disconnect you from the internet a few times so make sure nobody else is using the internet before you start.

Step 1: Installing the packages

SSH into your OpenWRT device and run the following:

opkg update
opkg install luci-proto-wireguard luci-app-wireguard wireguard kmod-wireguard wireguard-tools
reboot

(protip: Windows 10 has built in SSH support if you don't have PuTTY installed. You can also use LuCI to install these packages by going to System>Software)

Step 2: Creating a firewall rule

Go into LuCI and head to Network>Firewall>Port Forwards

Create a new rule using the following input:

Name: WireGuard
Protocol: UDP
External Zone: WAN
External Port: 1234
Internal Zone: LAN
Internal IP Address: <The IP address of your device, mine is 192.168.1.1>
Internal Port: 1234

Click Add, then Save & Apply. This allows your VPN clients (Phone, Laptop etc) to connect to your OpenWRT device from the internet.

The accept above assumes your OpenWRT device is not your main router. If your OpenWRT device is what connects you to your ISP then you should not do a port forward. You should add a Traffic Rule. If you are in this situation, remove the port forward that you created, and add a Traffic Rule, specifically open the port on the router. I named mine "Allow Wireguard", UDP, port 51820 (that's the port I'm using for wireguard, if you followed the guide above, use 1234).

Step 3: Generating the keys

SSH into your OpenWRT device and run the following:

umask 077 && wg genkey > privkey
cat privkey | wg pubkey > pubkey
cat /root/pubkey
cat /root/privkey

This creates two files in the /root/ directory of your device, pubkey and privkey.

You should email yourself the pubkey or transfer it securely to your phone somehow because you'll need it when setting up the VPN connection.

Copy the private key to your clipboard because you'll need it for Step 4.

Step 4: Setting up the WireGuard interface

  1. Go into LuCI and head to Network>Interfaces>Add New Interface
  2. Set the name of the new interface as wg0
  3. Set the protocol to WireGuard VPN
  4. Click Submit
  5. Paste the private key you got from Step 3 into the Private Key field
  6. Set the listen port to 1234
  7. In the IP Addresses field, type 10.14.0.0/16
    1. Step 4.7. is not quite right with 10.14.0.0/16. It should have a non-zero address. 10.14.0.1/24 for example
  8. Go to the Firewall Settings tab and assign the interface to your LAN zone if it's not automatically been assigned. This will enable you to access your LAN devices when you're connected to your VPN. If you want to keep your devices seperate, you can create another Firewall zone specifically for the WireGuard Interface.
  9. Click Save & Apply

Step 5: Setting up the VPN connection on an Android device

  1. Download the WireGuard app from the Play Store or F-Droid or whatever is your preferred source of apps
  2. Open the WireGuard app
  3. Tap the plus icon and go to "Create from scratch"
  4. Make up a name for your VPN connection
  5. Tap "Generate" to generate yourself a public and private key
  6. In the Addresses field, type 10.14.0.3/32
  7. Leave the Listen Port and MTU fields empty unless you need to change them for whatever reason
  8. In the DNS servers field, either type the address of your home DNS server or use a DNS server of your choice (e.g. 1.1.1.1)
  9. Tap Add Peer
  10. Paste the Public Key from the /root/ directory of your OpenWRT device
  11. Leave the Pre-shared key field blank
  12. In the Allowed IPs field, type 0.0.0.0/0,::0 (You should add ::0 even if you aren't using IPv6, as this stops your device from leaking data when connected to IPv6 enabled sites.)
  13. In the Endpoint field, type the public (WAN) IP address or domain name of your OpenWRT device, followed by a colon and the port number. For example: 69.65.164.12:1234
  14. In the Persistent Keepalive field, type 25
  15. Save the connection

Step 6: Adding your phone to the list of allowed peers

Now you have to register your phone as a peer to your OpenWRT device. To do this:

  1. In the WireGuard app, copy your Public Key (The one you generated earlier) to the clipboard
  2. Go into LuCI and head to Network>Interfaces
  3. Click Edit on the WireGuard interface
  4. Go to the Peers section and add click Add
  5. Paste the Public Key from your phone into the Public Key field
  6. In the Allowed IPs field, type 10.14.0.3/32
  7. Check the Route Allowed IPs checkbox
  8. Leave the Endpoint Host and Endpoint Port fields blank
  9. In the Persistent Keepalive field, type 25
  10. Click Save & Apply
  11. Reboot the OpenWRT device, either through LuCI>System>Reboot or by typing reboot in SSH

Step 7: Testing the VPN Connection

Theoretically, everything should be finished now. To test this, go into the WireGuard app and enable the VPN connection. Then open a browser and if you have internet connectivity then it worked. :)

(protip: The WireGuard app has it's own quick settings tile, so you can add it to your quick settings panel for ease of access)

If you have any questions or if it straight up didn't work, leave a comment and I'll try to help as best I can.

 

Important NOTES (From Reddit)

Always restart WG0 interface when adding new peers.

I see one bug and one potentially off step in the above guidance.

Step 2 assumes your OpenWRT device is not your main router. If your OpenWRT device is what connects you to your ISP then you should not do a port forward. You should add a Traffic Rule. If you are in this situation, remove the port forward that you created, and add a Traffic Rule, specifically open the port on the router. I named mine "Allow Wireguard", UDP, port 51820 (that's the port I'm using for wireguard, if you followed the guide above, use 1234).

 

If that's not it you might want to start a new post with some info. Such as:

  • What are you trying to accomplish - connecting a device to your home network from the public Internet? Or something else?

  • Does the OpenWRT router have Internet access? Test via Network > Diagnostics > Ping openwrt.org

  • When the client device connects, can it ping 8.8.8.8? openwrt.org? the router wireguard IP?

  • Output of 'cat /etc/config/network' on the OpenWRT router. (remove the keys and any public wan IP)

  • List the configuration you applied to your client device.

  • Output of 'wg show' on the router. (these are public keys, but you could redact them as well)

  • Output of 'iptables -L -v' on the OpenWRT router.

When you capture the output as text, put them in code formatted blocks in the Reddit post. There is also a lot more traffic on the OpenWRT forum than here. So if you don't get much response here it might be worth posting to that forum as

 

Desktop Client

Get TunSafe

Then Configuration File:

[Interface]

# The private key of this computer. This is a secret key, don't give it out.
# To convert it to a public key you can go to 'Generate Key Pair' in TunSafe.
PrivateKey = privatekey of client here

# Switch DNS server while connected
DNS = 8.8.8.8

# The addresses to bind to. Either IPv4 or IPv6. /31 and /32 are not supported.
Address = 10.14.0.4/24  # do same on wireguard server

[Peer]
# The public key of the peer. Do not use the private key here. Use the 'Generate Key Pair'
# function in TunSafe to convert a private key to a public key.
PublicKey = tvKWZt+WjmmKTLhy3zPDJ41TBOfv32o9G+tOJ+619mk=

# It's also possible to use a preshared key for extra security
# PresharedKey = SNz4BYc61amtDhzxNCxgYgdV9rPU+WiC8woX47Xf/2Y=

# The IP range that we may send packets to for this peer.
AllowedIPs = 0.0.0.0/0

# Address of the server
Endpoint = www.stoplagging.com:1234

# Send periodic keepalives to ensure connection stays up behind NAT.
PersistentKeepalive = 25

 

[Interface]
PrivateKey = WLdgS0NuPf6loHyrXxzcv/+iBoXScrambleExample=
DNS = 8.8.8.8 
Address = 10.14.0.5/24
[Peer]
PublicKey = tvKWZt+WjmmKTLhy3zPDJ41TBOfv32o9G+tOJ+619mk=
Endpoint = www.stoplagging.com:1234
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

 

 

Back to top