Openwrt Wireguard VPN Server Installation and Management

To install WireGuard on OpenWRT, you'll need to access the LuCI web interface. This is usually done by navigating to your router's IP address in a web browser.

The LuCI web interface is the default interface for managing OpenWRT, and it provides a user-friendly way to configure your router.

To access the LuCI web interface, you'll need to know your router's IP address, which is usually 192.168.1.1 by default.

Readers also liked: Setup Openwrt Luci Https through Command Line

To set up WireGuard on your OpenWRT router, you'll need a few things. First, make sure your router runs on the free OpenWRT operating system with the LuCI interface installed. You may void your warranty by installing it, so be aware of that.

You'll also need a VPN server that provides WireGuard access, which your VPN provider will give you the necessary credentials for. We'll be using Shellfire VPN in this guide.

In addition, you'll need a PC with an internet browser and the possibility to establish an SSH connection, although this is optional since April 2023.

To install WireGuard on your OpenWRT router, log into the LuCI web interface, which can usually be found at http://192.168.1.1/. Click on "System -> Software" and then click on "Update lists" to search for the latest available software packages.

You'll need to install the packages "kmod-wireguard", "luci-proto-wireguard" or "luci-app-wireguard", and "wireguard-tools".

To create the keys, you can run the following commands:

You can then paste the generated keys into the corresponding fields in the web interface.

Here's a quick rundown of the necessary packages to install on your OpenWRT router:

Remember to restart your router after installing the necessary packages.

To configure WireGuard on OpenWRT, start by creating a new interface and selecting WireGuard VPN as the protocol. Click on "Add new interface" in the LuCI web interface and follow the steps to configure the interface.

You can either use a configuration file or manually enter the public key generated via SSH. If using a configuration file, extract the archive, open the file with a text editor, and copy its contents. Paste the contents into the Load configuration... button in the General Settings tab.

To optimize WireGuard's performance on OpenWRT, consider setting the MTU to 1412 in the Advanced Settings tab. Also, ensure that the Route Allowed IPs option is checked in the Peers tab, and set the Persistent Keep Alive to 25.

Creating an Interface is a crucial step in setting up your WireGuard VPN. You can generate a WireGuard config file with the preferred server and parameters.

To create an interface, you'll need to navigate to Network - Interfaces in OpenWRT and click on the Add new interface button. Give it any name, such as ivpnAustria, and set Protocol to WireGuard VPN.

Here's a step-by-step guide to creating an interface:

1. Generate a WireGuard config file with the preferred server and parameters.

2. Extract the archive, open the file with any text editor, and copy its contents.

3. In OpenWRT, navigate to Network - Interfaces, click on the Add new interface, and give it a name.

4. Set Protocol to WireGuard VPN and click on the Create interface button.

5. In the General Settings tab, click on the Load configuration... button and paste the contents of the WireGuard config file.

6. Click on the Import settings button.

7. In the Advanced Settings tab, set MTU to 1412.

8. In the Peers tab, click Edit next to the imported peer configuration, check the Route Allowed IPs option, set Persistent Keep Alive to 25, and click Save.

9. Click Save & Apply.

Remember to specify the correct account ID format when generating the WireGuard config file. If you have an IVPN subscription created before November 2020, contact customer service to help you make the switch.

To add users who will be using the service, head to Network > Interfaces and click the Edit button.

You'll then go to the Peers tab and click the green Add peer button.

Before filling in the fields for the first user, ensure you have their Public key and Private key.

To create the Private key and Public key for the first user, run the following command.

Enter a static address that will be used by the client, similar to the server's IP address, in the Allowed IPs section.

For example, you might enter 10.0.0.2/32 or fd42:42:42:1::2/128, where the IP address ends with /32 (for IPv4) or /128 (for IPv6).

Each user is assigned a single IP address, meaning a single credential can only be used to connect one device at a time.

If you have more than one internet connection set up using mwan3, leave Route Allowed IPs unchecked.

In Persistent Keep Alive, enter the value 25.

Press the Save button to add the peer configuration.

The next user will have new keys generated and allowed IPs in the next order, i.e., 10.0.0.3/32 and fd42:42:42:1::3/128.

Once all peers have been added, confirm everything with the Save button.

In the interfaces section, click Save & Apply.

At this stage, you must also restart the WireGuard interface to refresh the configurations and peers that have just been added.

If this caught your attention, see: Openwrt One

To configure the Wireguard VPN client, start by navigating to the LuCI web interface and clicking on "Network -> Interfaces". Select "Add new interface" and specify a name for your connection, such as "wg0", and choose "Wireguard VPN" as the protocol.

Next, you can skip this step if you used a configuration file, but if not, click on the "Edit" symbol in the Customer Center and enter your public key generated via SSH.

Click on "Save & Apply" to save your changes and apply the configuration.

Setting up WireGuard on OpenWRT can be a breeze, but sometimes you may encounter issues that hinder the proper functioning of your VPN. This is where advanced configuration and troubleshooting come into play.

Firewall Configuration is crucial to ensure that the necessary ports are open. WireGuard uses UDP port 51820 by default, so it's essential to allow traffic on that port. This is often overlooked, but it's a common cause of connection errors.

If WireGuard isn't connecting, check the following common issues: Firewall Configuration: Ensure that the necessary ports are open.Incorrect IP Addresses: Verify that the IP addresses assigned on both ends match the peer configuration.Mismatched Public/Private Keys: Review the cryptographic keys.

Frequent disconnections may indicate an issue with WireGuard's keep-alive settings. Configuring the PersistentKeepalive parameter in your peers ensures the connection stays active, even when there isn't constant traffic. This is a simple yet effective solution to prevent connection drops.

Discover more: Google One Vpn Wireguard

To ensure your LAN devices only use the VPN tunnel, you need to edit your lan firewall zone. Remove WAN from the Allow forward to destination zones field.

This will prevent any possible leaks if your router disconnects from the VPN server for any reason.

Click the Save & Save & Apply buttons to apply the changes.

Consider reading: Wake on Lan Openwrt

Optimizing WireGuard's performance on OpenWRT can make a significant difference in both speed and security.

For advanced users, optimizing WireGuard's performance on OpenWRT is a worthwhile investment of time. It can be done by tweaking various settings, such as the MTU size, which affects packet fragmentation and reassembly.

The default MTU size for WireGuard on OpenWRT is 1420, but you can adjust it to a lower value, such as 1280, to improve performance on certain networks.

Using the correct MTU size can significantly reduce packet loss and improve overall throughput.

If WireGuard isn't connecting, check the firewall configuration to ensure the necessary ports are open, specifically UDP port 51820 by default.

Incorrect IP addresses assigned on both ends can cause connection errors, so verify that the IP addresses match the peer configuration.

Mismatched public and private keys can prevent WireGuard from establishing a secure connection, so review the cryptographic keys.

Frequent disconnections may indicate an issue with WireGuard's keep-alive settings, where configuring the PersistentKeepalive parameter can help keep the connection active.

Here are some common issues and their solutions:

To create a firewall zone, you need to configure your router's firewall settings in the OpenWRT LuCI interface by clicking on Network -> Firewall and then "Add". The necessary settings can be found in the screenshot provided.

First, you need to click on Network -> Firewall and select the Traffic Rules tab. Then, scroll to the bottom of the rules and press the green Add button. Next, add the rule as shown in the image below.

To add a firewall rule for your WireGuard server, you can execute the following command in the terminal: "For the iOS app, we introduced the server’s Public key, client IP address (Addresses), name server (DNS servers), Endpoint, Allowed IPs, and Persistent keepalive, all of which are missing here."

To create a firewall zone, click on Network in the OpenWRT LuCI interface, then on Firewall, and finally on "Add".

This is where you'll configure your router to handle data flowing through the Wireguard interface.

You can find the necessary settings in the screenshot provided.

Click "Save and Apply" to save your changes and implement the new firewall configuration.

Additional reading: Openwrt Interface

To add firewall rules, you'll want to navigate to Network > Firewall in the OpenWRT LuCI interface.

You can find the necessary settings by clicking on "Add" and following the screenshot provided. When you're done, click "Save and Apply".

To add a rule manually, go to Network > Firewall and select the Traffic Rules tab. Scroll to the bottom of the rules and press the green Add button. Add the rule as shown in the image below.

Here are the steps to add a firewall rule using the terminal:

1. Execute the following command in the terminal to add a firewall rule.

2. Follow by restarting the firewall using the command below:

Note that the iOS app requires additional settings such as the server's Public key, client IP address, name server, Endpoint, Allowed IPs, and Persistent keepalive, which are missing in this setup.

WireGuard uses public key encryption, which requires each party to generate their own key pair, consisting of a public key and a private key.

To create the key pair, log in to your router via SSH, using the IP address and router password. The username is "root".

Create a new folder called /etc/wireguard and change into that folder.

Generate the key pair, but be aware that the private key must never fall into the wrong hands.

Transfer the private key to the "Private Key" field, marked as 1 in the screenshot.

You should never give away your private key, as an attacker can decrypt any data encrypted with it.

Here's a step-by-step guide to key generation:

Remember, your private key is the most sensitive part of the key pair, so keep it safe.

To set up DNS on your OpenWRT WireGuard network, you'll want to head to the Network - Interfaces page. From there, click on the Edit button next to the WAN interface.

To disable your ISP's DNS servers, uncheck the box that says "Use DNS servers advertised by peer" and enter the WireGuard regular DNS server IP address, 172.16.0.1, or the one associated with your preferred AntiTracker list.

If your ISP provides you with an IPv6 IP address, you'll need to repeat these steps for the WAN6 interface.

A fresh viewpoint: Openwrt Dynamic Dns

Reducing latency with MTU can make a big difference in your network performance. Adjusting the MTU can help reduce latency and improve connection stability.

The default setting is usually sufficient, but in some cases, manually adjusting it can offer benefits. In the WireGuard interface on OpenWRT, try lowering the MTU if you notice network performance delays.

Typically, adjusting to values between 1280 and 1420 can be helpful. This range allows WireGuard to operate at its peak performance on your OpenWRT router, optimizing both speed and security.

By making this adjustment, you can enjoy a more stable and responsive network connection.

To configure your DNS settings, you'll want to navigate to the Network - Interfaces section. Click on the Edit button next to the WAN interface, which is where you'll find the DNS settings.

You'll need to uncheck the box that says "Use DNS servers advertised by peer" and enter the WireGuard regular DNS server IP address, which is 172.16.0.1, or the one associated with the preferred AntiTracker list. Make sure to click Save after making these changes.

If your ISP also provides you with an IPv6 IP address, you'll need to repeat these steps for the WAN6 interface. This is an important step to ensure that your DNS settings are properly configured for both IPv4 and IPv6.

To confirm that your changes have taken effect, click Save & Apply. This will apply the new DNS settings to your network.

Related reading: Openwrt Ipv6 出错

To confirm everything is working as expected, you don't necessarily need to reboot your device, but it's a good idea to do so.

A leak test can be run via one of the internal network clients attached to your OpenWRT router at https://www.dnsleaktest.com.

You should have already restarted your router after installing the necessary packages, but just to be sure, let's confirm the DNS servers are set to 192.168.1.1.

For your interest: Openwrt Travel Router

Now that you've completed the setup, it's time to finalize the process. A device reboot is not required, but it may be useful to confirm that everything behaves as expected.

To ensure your internet connection is secure, run a leak test at https://www.dnsleaktest.com via one of the internal network clients attached to your OpenWRT router.

Before you proceed with the final steps, make sure to restart your router after installing the necessary packages. This is crucial for the changes to take effect.

DNS servers are typically set to 192.168.1.1, which you'll want to note down for future reference.

To confirm your DNS servers, check your router's settings or the IP address provided in your router's documentation.

Setting up WireGuard on OpenWRT is typically straightforward, but some users may encounter issues that hinder proper functioning.

Connection Error: WireGuard Fails to Connect

Check the firewall configuration to ensure necessary ports are open. WireGuard uses UDP port 51820 by default, so it's essential to allow traffic on that port.

Common Causes of Connection Errors

To troubleshoot your WireGuard setup, start by checking the server's status in the web interface. Go to Status > WireGuard to see the server's public key and the port it's running on.

The public key is a unique identifier for your server, and the port number is important for setting up client connections. Make a note of these details for future reference.

Setting Persistent keepalive to 25 is also a crucial step in ensuring your connections stay stable. This setting helps maintain a healthy connection between your server and client devices.

Connection Error is a frustrating issue that can be caused by a few simple mistakes. Ensure that the necessary ports are open, as WireGuard uses UDP port 51820 by default.

Firewalls can be tricky, but it's essential to allow traffic on the correct port to ensure a stable connection. I've seen users forget to open this port, leading to a connection error.

Incorrect IP addresses are another common cause of connection errors. Verify that the IP addresses assigned on both ends match the peer configuration.

Mismatched public and private keys can also prevent WireGuard from establishing a secure connection. Review the cryptographic keys to ensure they match.

Here are the most common causes of connection errors, summarized:

By addressing these common issues, you can ensure a stable and secure VPN connection, protecting your privacy while browsing public and private networks.

To set up WireGuard on OpenWrt, start by selecting Create from scratch, as we're starting from the beginning.

You'll then enter your configuration, beginning with a name for your user, such as User1.

The private key field will be pre-filled with your user1-privatekey, which you can find by navigating to Network > Interfaces, clicking edit next to your WireGuard interface (wg0), going to the Peers tab, and copying the public key from there.

Enter the server's public key in the Public key field, which can be found by navigating to Network > Interfaces, clicking edit next to your WireGuard interface (wg0), going to General Settings, and copying the public key from there, or by using the command cat /etc/wireguard/server-publickey on your router.

To set the endpoint, enter your router's external IP address and port, such as 123.34.45.56:443, where 123.34.45.56 is the IP address and 443 is the port.

In the Allowed IPs field, set 0.0.0.0/0, ::/0, which allows visibility of devices on the local network.

After setting up your configuration, your phone will prompt you to add the VPN configuration to the settings, which you should allow.

OpenWRT as a WireGuard client can be a bit finicky, but here are a few things I've learned from my own experience.

If your WireGuard connection breaks due to a network outage or reboot, the wireguard_watchdog script can help. It's part of the OpenWRT WireGuard package and can detect the broken state and kick things back into gear.

You might need to add a few extra lines to the script to get it working properly, though. For example, adding `ifdown wginterface` and `ifup wginterface` can help kick things back into gear.

Shifting the wg0 interface from the WAN to the LAN is just a matter of changing two lines in the script from "wan" to "lan". This allows you to access the SSH on the LAN side via the remote WireGuard connection, which can be very useful.

Here are the specific changes you'll need to make:

Keep in mind that making this change can break clients on the remote LAN side from seeing the home network over WireGuard.