¶ WireGuard client
¶ Introduction
- This how-to describes the method for setting up WireGuard client on OpenWrt.
- Follow WireGuard server for server setup and WireGuard extras for additional tuning.
¶ Goals
¶ Command-line instructions
¶ 1. Preparation
Install the required packages. Specify configuration parameters for VPN client.
# Install packages
wireguard-tools
# Configuration parameters
VPN_IF="vpn"
VPN_SERV="SERVER_ADDRESS"
VPN_PORT="51820"
VPN_ADDR="192.168.9.2/24"
VPN_ADDR6="fd00:9::2/64"
¶ 2. Key management
Generate and exchange keys between server and client.
# Generate keys
umask go=
wg genkey | tee wgserver.key | wg pubkey > wgserver.pub
wg genkey | tee wgclient.key | wg pubkey > wgclient.pub
wg genpsk > wgclient.psk
# Client private key
VPN_KEY="$(cat wgclient.key)"
# Pre-shared key
VPN_PSK="$(cat wgclient.psk)"
# Server public key
VPN_PUB="$(cat wgserver.pub)"
¶ 3. Firewall
Consider VPN network as public. Assign VPN interface to WAN zone to minimize firewall setup.
# Configure firewall
uci rename firewall.@zone[0]="lan"
uci rename firewall.@zone[1]="wan"
uci del_list firewall.wan.network="${VPN_IF}"
uci add_list firewall.wan.network="${VPN_IF}"
uci commit firewall
service firewall restart
¶ 4. Network
Configure VPN interface and peers.
# Configure network
uci -q delete network.${VPN_IF}
uci set network.${VPN_IF}="interface"
uci set network.${VPN_IF}.proto="wireguard"
uci set network.${VPN_IF}.private_key="${VPN_KEY}"
uci add_list network.${VPN_IF}.addresses="${VPN_ADDR}"
uci add_list network.${VPN_IF}.addresses="${VPN_ADDR6}"
# Add VPN peers
uci -q delete network.wgserver
uci set network.wgserver="wireguard_${VPN_IF}"
uci set network.wgserver.public_key="${VPN_PUB}"
uci set network.wgserver.preshared_key="${VPN_PSK}"
uci set network.wgserver.endpoint_host="${VPN_SERV}"
uci set network.wgserver.endpoint_port="${VPN_PORT}"
uci set network.wgserver.persistent_keepalive="25"
uci set network.wgserver.route_allowed_ips="1"
uci add_list network.wgserver.allowed_ips="0.0.0.0/0"
uci add_list network.wgserver.allowed_ips="::/0"
uci commit network
service network restart
Resolve race conditions and configure dynamic connection if necessary.