WireGuard on OpenWrt: a practical guide to secure VPNs on home routers

Why WireGuard on openwrt makes sense

WireGuard is designed to be lean and easy to audit, with a small codebase and fast cryptography. OpenWrt provides a flexible, package-based approach to add services to your router. Together, they let you:

• Create a secure tunnel between your home network and a remote device or network.
• Maintain high throughput on modest hardware.
• Avoid complex VPN protocols and configurations that can bog down consumer routers.
• Apply per-client access controls and simple split-tunneling if needed.

In practice, you can set up a site-to-site link between a home router and a trusted remote network, or you can configure a client device (laptop, phone, or another router) to connect to your OpenWrt box.

Prerequisites and planning

Before you begin, gather and verify a few essentials:

• A router with OpenWrt installed (ideally latest stable release for security updates).
• Sufficient flash and RAM for WireGuard and firewall rules.
• Access to the LuCI web interface or SSH for configuration.
• A public IP or a dynamic DNS setup if you plan to reach the OpenWrt router from the internet.

Decide on:

• The role of the OpenWrt device: gateway only, or also an intermediate tunnel hub.
• A private network range for the VPN: choose a distinct CIDR from your LAN, such as 10.200.200.0/24 or 192.168.100.0/24.
• How you’ll handle keys: generate on a trusted device, then transfer securely to the router and clients.

Installing WireGuard on openwrt

OpenWrt packages for WireGuard are named wireguard and wireguard-tools, with luci-app-wireguard to simplify the UI. WireGuard on QNAP

• Update package lists and install:
• opkg update
• opkg install wireguard luci-app-wireguard wireguard-tools luci-proto-wireguard
• If your device has limited storage, you can install packages selectively using opkg.
• After installation, you should see a new WireGuard section in LuCI (Network > Interfaces).

If you prefer the command line only:

• Create a new interface type: wg0 with the protocol wg
• WireGuard uses public/private keys for peers. You’ll generate keys locally and paste the public keys to your OpenWrt peers.

Generating keys and configuring peers

Key management is central to WireGuard’s security.

• On a secure machine, generate a private and public key pair:
• wg genkey > privatekey
• wg pubkey < privatekey > publickey
• Copy these values to OpenWrt:
• PrivateKey: the private key
• ListenPort: choose a high unused port (e.g., 51820)
• Peers: each remote peer has its own PublicKey, AllowedIPs, Endpoint, and PersistentKeepalive
• For each client you want to connect, repeat the process: generate a key pair, share the public key with the OpenWrt side, and configure the client with the OpenWrt’s public key and endpoint.

If you need multiple clients, you can reuse a single WireGuard interface with multiple peers, one per client.

Configuring the openwrt interface and firewall

The VPN interface needs both an internal IP address and firewall rules to function properly.

• Assign a private IP to the wg0 interface (e.g., 10.200.200.1/24).
• Add firewall zone for wg0 with appropriate input/output forward rules.
• Allow VPN traffic: permit ICMP if you want ping through, and allow the WireGuard port on WAN if the tunnel terminates at your OpenWrt device.
• Consider enabling NAT for VPN clients if you want them to access the internet via your OpenWrt router.

Sample firewall actions: WireGuard on Debian

• Create a new zone: wg
• Input: reject (or drop)
• Output: accept
• Forward: accept
• In the built-in zones, add the WG firewall to allow traffic from VPN to LAN and to WAN as needed.
• Enable MASQUERADE on the WG zone if your VPN clients should NAT to the internet.

Routing and split tunneling

WireGuard can route all traffic through the VPN or only traffic to specific networks.

• To route all traffic, set AllowedIPs for peers to 0.0.0.0/0 and::/0.
• To split-tunnel, set AllowedIPs to your LAN subnets (e.g., 192.168.1.0/24) or other networks you want to reach through the VPN, leaving internet traffic to go through your normal WAN.

On OpenWrt, you can implement split tunneling by carefully selecting AllowedIPs for each peer and using policy-based routing for client devices if needed.

Client access and addressing

Each client on the VPN needs to know:

• The OpenWrt wg0 endpoint address (the server’s public key and endpoint).
• The internal VPN IP to use on the client side (e.g., 10.200.200.2 for the first client).
• Any DNS settings if you want clients to resolve names via VPN (e.g., using a DNS server on the OpenWrt device).

To reach devices on the VPN, ensure the LAN devices know how to reach VPN routes, and that client routing tables are properly configured.

Table: quick comparison of common WireGuard OpenWrt setups WireGuard on Windows Server: a practical guide to setting up and managing WireGuard on Windows Server

Testing and troubleshooting

After configuration, test each peer:

• Use wg show on OpenWrt to verify peer connections and traffic.
• From a client device, try to ping the VPN internal IP (e.g., 10.200.200.1).
• Verify that traffic you want to go through VPN is routed as intended (use traceroute or equivalent).
• Check that the firewall rules do not block VPN traffic and that NAT is correctly applied if you expect outbound internet access from VPN clients.

Common issues:

• Incorrect AllowedIPs on peers causing no traffic.
• Endpoint reachable but handshake failing due to misconfigured keys or ports.
• Firewall blocking WG_PORT (usually 51820) inbound or outbound.
• DNS leaks if the client relies on default DNS instead of VPN DNS.

Security considerations and best practices

• Use long, random private keys and rotate them if you suspect exposure.
• Keep your OpenWrt firmware and all packages up to date. Enable automatic security updates if possible.
• Enforce strong firewall rules: allow only necessary traffic, drop others, and use NAT only where needed.
• Consider enabling persistent_keepalive on peers that are behind NAT to maintain connectivity.
• Back up your WireGuard configuration including private keys in a secure location.
• Limit access by IPs or firewall rules on your WAN interface to reduce exposure to the internet.

Monitoring and maintenance

• Regularly check wg status and log files for unusual activity or drops.
• Monitor CPU load to ensure WireGuard isn’t overtaxing your device, particularly on older routers.
• Update keys periodically as part of your security hygiene, but keep a robust backup of current configs during rotations.
• If you change network topology or add/remove peers, update both sides consistently to avoid orphaned configurations.

A practical example: a minimal site-to-site setup

Here’s a concise example to illustrate a basic site-to-site configuration.

• OpenWrt (Site A)

• Interface: wg0 WireGuard on Proxmox: a practical guide to setting up secure peer-to-peer VPN on Proxmox VE

• Address: 10.200.200.1/24

• ListenPort: 51820

• PrivateKey: [server-private-key]

• Peer (Site B)

• PublicKey: [site-b-public-key] WireGuard on OPNsense: How to implement VPN securely and efficiently

• AllowedIPs: 10.200.200.0/24, 192.168.2.0/24

• Endpoint: remote.siteb.example:51820

• PersistentKeepalive: 25

• Site B Client (Site C LAN)

• If you’re wiring through a dedicated device or another OpenWrt, mirror the roles: WireGuard on Home Assistant

• Interface: wg0

• Address: 10.200.200.2/24

• PrivateKey: [site-b-private-key]

• Peer (Site A)

• PublicKey: [site-a-public-key]

• AllowedIPs: 10.200.200.0/24, 192.168.1.0/24

• Endpoint: your-home-router.example:51820

• PersistentKeepalive: 25

In this simplified example, both sites can reach each other’s VPN networks, and devices on the 192.168.1.0/24 and 192.168.2.0/24 subnets can communicate through the VPN.

Final recommendation

WireGuard on OpenWrt offers a fast, secure, and relatively straightforward path to a reliable VPN for home networks. Start with a simple, well-documented configuration, and expand gradually as you test and validate. Keep security at the forefront: manage keys carefully, lock down firewall rules, maintain updates, and monitor health and performance. If you’re new to VPNs, consider starting with a client-to-site setup for a single device to learn the ropes before scaling to a full site-to-site or multi-client deployment. With careful planning and ongoing maintenance, WireGuard on OpenWrt can be a robust backbone for your home network's privacy and connectivity.