Security · TUTORIAL

Set Up a WireGuard VPN on OpenWrt

WireGuard is a fast, modern VPN that runs in the Linux kernel and is well supported by OpenWrt. This guide sets up a WireGuard server so you can reach your home network from anywhere.

Last updated: 2026-10-07

Scope and assumptions

OpenWrt version: OpenWrt 22.03 and later (firewall4/fw4). Package commands show 25.12 (apk); OpenWrt 24.10 and earlier use opkg.
Last verified against official sources: 2026-10-07

Hardware, target and driver assumptions

A router whose target provides the WireGuard kernel module (built in or as kmod-wireguard). Availability and the exact module name vary by device; check your device page.
The router has a reachable public IPv4 or IPv6 address. Behind CGNAT there is no inbound path, so a remote peer cannot connect.
Clock synchronisation (NTP) works, because WireGuard refuses to pass traffic when peer clocks are far apart.

Recovery and rollback warnings

Keep your current SSH or LuCI session open while you change firewall zones. Adding the VPN to the wrong zone can cut off remote access; test from a second session first.
If your ISP uses CGNAT, inbound UDP 51820 will never reach the router. The tunnel will simply not come up; this is a network limitation, not a misconfiguration you can fix on the router.
WireGuard keys and the pre-shared key must match exactly on both sides. Regenerating a key without updating the peer breaks the tunnel.

Install the WireGuard packages

Install the WireGuard userspace tools and the LuCI protocol support. The `luci-proto-wireguard` package pulls in `wireguard-tools`; the kernel module may be built into your target or supplied by `kmod-wireguard`.

After installing, restart the network service so the new protocol appears: Network → Interfaces shows "WireGuard VPN" in the protocol menu.

apk update
apk add wireguard-tools luci-proto-wireguard kmod-wireguard

OpenWrt 25.12 and later (apk). On OpenWrt 24.10 and earlier use `opkg update` and `opkg install ...` instead. If `kmod-wireguard` is already built in, the install reports it as provided and nothing else changes.

Generate the server keys

WireGuard uses public-key cryptography. Generate a key pair on the router: the private key stays on the server, and the public key is shared with peers.

A pre-shared key adds a symmetric layer on top of the public keys. Each peer should have its own pre-shared key.

umask u=rw,go=
wg genkey | tee server_private.key | wg pubkey > server_public.key
wg genpsk > peer_psk.key

Generates the server key pair and one pre-shared key. `umask u=rw,go=` keeps the key files readable only by root.

Configure the WireGuard interface

The interface needs the server private key, a listen port (51820 is the conventional default) and an address from a dedicated VPN subnet that does not overlap your LAN or WAN ranges.

The command below uses double quotes so the shell substitutes `$(cat server_private.key)`. In single quotes the shell would pass the literal text `$(cat ...)` and the key would be wrong.

uci set network.wg0='interface'
uci set network.wg0.proto='wireguard'
uci set network.wg0.private_key="$(cat server_private.key)"
uci set network.wg0.listen_port='51820'
uci add_list network.wg0.addresses='10.0.0.1/24'
uci commit network

Double quotes around `$(cat ...)` are required; the shell expands the command substitution into the UCI value.

Add a peer

A peer is a client that connects to the VPN. Each peer needs its own public key and a unique address in the VPN subnet (for example 10.0.0.2).

Set "Route Allowed IPs" so OpenWrt installs a route to the peer through the WireGuard interface. For a client that should send all traffic through the VPN, set the allowed IPs on the client side to 0.0.0.0/0 instead.

uci set network.peer1='wireguard_wg0'
uci set network.peer1.public_key='peer-public-key'
uci set network.peer1.preshared_key="$(cat peer_psk.key)"
uci set network.peer1.allowed_ips='10.0.0.2/32'
uci set network.peer1.route_allowed_ips='1'
uci commit network

A named peer section on the wg0 interface. Again, double quotes expand the pre-shared key.

Firewall rules for the VPN

Add the WireGuard interface to a firewall zone. Adding it to the existing lan zone lets VPN clients reach the LAN and the internet; a separate zone gives finer control.

Then allow inbound UDP traffic on the listen port from the wan zone, otherwise remote peers cannot establish the tunnel.

uci add_list firewall.@zone[0].network='wg0'
uci add firewall rule
uci set firewall.@rule[-1].name='Allow-WireGuard'
uci set firewall.@rule[-1].src='wan'
uci set firewall.@rule[-1].dest_port='51820'
uci set firewall.@rule[-1].proto='udp'
uci set firewall.@rule[-1].target='ACCEPT'
uci commit firewall
fw4 reload

Adds wg0 to the first firewall zone (the default lan zone) and allows inbound UDP 51820 from the WAN.

Client configuration

On the client device (phone or laptop), install the WireGuard app and create a tunnel. Use the client private key, the address 10.0.0.2/32, and a peer with the server public key, the pre-shared key, the server public IP and port 51820.

Set AllowedIPs on the client to 192.168.1.0/24 for split-tunnel access to the LAN only, or 0.0.0.0/0 to send everything through the VPN. The LAN subnet in this example is 192.168.1.0/24; substitute your own.

[Interface]
PrivateKey = <client-private-key>
Address = 10.0.0.2/32

[Peer]
PublicKey = <server-public-key>
PresharedKey = <peer-psk>
Endpoint = your.router.ip:51820
AllowedIPs = 192.168.1.0/24

A client WireGuard config for split-tunnel access to the LAN only.

Frequently asked questions

Is WireGuard faster than OpenVPN?

Usually. WireGuard runs in the kernel and uses modern ciphers, so throughput is often higher at lower CPU cost. The exact difference depends on your hardware.

Do I need a public IP for WireGuard?

For a server that remote clients connect to, yes. Behind CGNAT there is no inbound path; run the server on a host with a public address, or use a mesh/relay solution.

How many peers can WireGuard handle?

WireGuard itself supports many peers; the practical limit is the router CPU and RAM. A typical home router handles a small number of simultaneous tunnels comfortably.

Sources

Checked against the official OpenWrt documentation on 2026-10-07. Behaviour that depends on release, target or hardware is called out in the steps above.

Written for wrtstudio.com. Tutorials are updated as OpenWrt releases evolve.