# Help with WireGuard please **URL:** \ **Category:** Installing and Using OpenWrt\ **Created:** [August 5, 2018, 3:40am UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279 "2018-08-05T03:40:19Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![ZOzo](https://forum.openwrt.org/letter_avatar/zozo/32/5_5575768a8748004e209b776fc1b2916d.png) [@ZOzo](https://forum.openwrt.org/u/ZOzo)\ **Post date:** [August 5, 2018, 3:40am UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279/1 "2018-08-05T03:40:19Z")
Can someone please help me with my wireguard config? I would like to create a wireguard tunnel between the router A and B below: Clients A = 10.0.0.5-10.0.0.33 with Router 10.0.0.1 with DNS 10.0.0.1 & 192.168.100.1 | | Router A OpenWrt with wireguard install = LAN 10.0.0.1 with WAN 192.168.100.10 | | | | Getaway A Huawei GPON = 192.168.100.1 with dynamic IP on WAN from ISP with NoIP DNS [my-BASE-domain.com](http://my-BASE-domain.com) || || || ||ISP || ||Internet || ||ISP || || || Getaway B Huawei 4G/LTE = 172.0.0.1 with dynamic IP on WAN from ISP with NoIP DNS [my-AWAY-domain.com](http://my-AWAY-domain.com) | | | | Router B OpenWrt with wireguard install = LAN 10.5.5.1 with WAN 172.0.0.10 | | Clients B = 10.5.5.5-10.5.5.33 with Router 10.5.5.1 with DNS 10.5.5.1 & 172.0.0.1 * * * Before posting here I've been trying my best to get it to work with no success. Really wish someone can help me out with this. After lot of time spent reading the wireguard website and looking at the simplicity of the thing, I thought it would have been as easy as setting up a pptp connection on a mac but unfortunately it is not. ---
**Author:** ![takimata](https://forum.openwrt.org/user_avatar/forum.openwrt.org/takimata/32/114647_2.png) [@takimata](https://forum.openwrt.org/u/takimata)\ **Post date:** [August 5, 2018, 2:46pm UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279/2 "2018-08-05T14:46:25Z")
"Does not work" is not a lot of information. What exactly did you do/try up to this point, what does work, and what doesn't? ---
**Author:** ![ZOzo](https://forum.openwrt.org/letter_avatar/zozo/32/5_5575768a8748004e209b776fc1b2916d.png) [@ZOzo](https://forum.openwrt.org/u/ZOzo)\ **Post date:** [August 5, 2018, 7:26pm UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279/3 "2018-08-05T19:26:46Z")
I followed all instruction as per what available on the wireguard website the video displayed [https://danrl.com/blog/2017/luci-proto-wireguard/](https://danrl.com/blog/2017/luci-proto-wireguard/) takimata past isues and post in the forum but no good so far, are there any firewall port to be opened, specifics NAT, port forwarding Is there a clear, sharp and concise guide related to Wireguard on OpenWRT somewhere to help? I take some time to describe to my best my network setup as there surely a specialist of the situation who will at some point read it and indicate how to get it to work. All instruction followed so far are not explicit enough and simple as "A B C D…" Only for engineers but not for noob's unfortunately ---
**Author:** ![ZOzo](https://forum.openwrt.org/letter_avatar/zozo/32/5_5575768a8748004e209b776fc1b2916d.png) [@ZOzo](https://forum.openwrt.org/u/ZOzo)\ **Post date:** [August 7, 2018, 4:54am UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279/4 "2018-08-07T04:54:19Z")
good help: > **[Wireguard - Part Two (VPN routing)](https://www.ericlight.com/wireguard-part-two-vpn-routing.html)** > > This is a continuation of my brief series on the new Wireguard VPN. Part One was about the simple building-blocks to get Wireguard working between two endpoints. Now that we've got a couple machines able to ping each other by IP address, we can carry... > **[Running WireGuard on a router - Guides | Mullvad](https://mullvad.net/en/guides/running-wireguard-router/)** > > Learn how to run WireGuard on a router. > **[wireguard.pdf](https://www.wireguard.com/papers/wireguard.pdf)** > > 537.11 KB Still on some more reading and almost having it working ---
**Author:** ![takimata](https://forum.openwrt.org/user_avatar/forum.openwrt.org/takimata/32/114647_2.png) [@takimata](https://forum.openwrt.org/u/takimata)\ **Post date:** [August 7, 2018, 3:39pm UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279/5 "2018-08-07T15:39:55Z")
I assume your goal is to connect your two private networks, each of them behind another edge router? It gets a bit tricky then. Not because any part of this in itself would be horribly complicated, but because you got a slightly more elaborate setup on your hands, and the whole will not work if you got any part of it wrong. - set up Wireguard on both of your OpenWrt devices - on each OpenWrt devices, enter the respective other peer's data (public key and IP range) - on the edge router in front of the OpenWrt device that acts as "server" have Wireguard's listening port forwarded to the OpenWrt device - if the "server" changes IP addresses, you need to take care of that on the "client" because Wireguard does not realize this on its own and will only resolve the "server" address once. [Recently, a helper script became available for that, it comes with the wireguard-tools package.](https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=f91a0f3b1aba95bcf3b248e02a89709ce0274fa7) - if you want to reach the "outer" network around your OpenWrt devices through Wireguard, it becomes even more complicated > [@ZOzo](#): > > Only for engineers but not for noob's unfortunately Not really "engineers", but this is definitely a topic for advanced users with at least a cursory knowledge about networking. With OpenWrt, most of the topics beyond basic operation are. Especially with anything beyond a basic setup, Wireguard definitely is not something that can be configured with just a few clicks (yet). ---
**Author:** ![lleachii](https://forum.openwrt.org/letter_avatar/lleachii/32/5_5575768a8748004e209b776fc1b2916d.png) [@lleachii](https://forum.openwrt.org/u/lleachii)\ **Post date:** [August 7, 2018, 3:56pm UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279/6 "2018-08-07T15:56:11Z")
This is actually simple and Wireguard makes things quite easy. - You merely have to stand up the tunnels. - You have to open the UDP ports that you selected as the listening port (at least one device must have the UDP port status and opened on the firewall and port forward on the "Gateway," the other can use keepalive) - You now need to number your tunnels, the scheme you listed above appears OK - **Make static routes to the networks on each router** > [@\[Solved\] Wireguard as a VPN "server"](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635/4): > > I literally set this up yesterday to see how easy it could be: IPs are managed by the kernels on either side. Therefore, you must use the correct CIDR prefix on the interfaces on both ends. (e.g. for a 2-peer configuration, you must use at least a /31 or /30 at the router-side of your traffic, the "client-end" can use the other available /32 in that subnet). I found a need to setup a different zone. The rules are different between networks, etc.; but this is solely your choice, considering th… > [@takimata](#): > > Wireguard definitely is not something that can be configured with just a few clicks (yet). But it does setup well via LuCI GUI! 👍 ---
**Author:** ![ZOzo](https://forum.openwrt.org/letter_avatar/zozo/32/5_5575768a8748004e209b776fc1b2916d.png) [@ZOzo](https://forum.openwrt.org/u/ZOzo)\ **Post date:** [August 7, 2018, 3:59pm UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279/7 "2018-08-07T15:59:35Z")
Thx takimata, finally got it working on 18.06 after lot of reading, its much easy enough compared to openvpn routing too is easier compared to openvpn though in the latter part of routing configs is to be done within, which then, yes, make the routing too more easier than openvpn. helper script used here: [http://teanazar.com/2016/05/godaddy-ddns-updater/](http://teanazar.com/2016/05/godaddy-ddns-updater/) ---
**Author:** ![ZOzo](https://forum.openwrt.org/letter_avatar/zozo/32/5_5575768a8748004e209b776fc1b2916d.png) [@ZOzo](https://forum.openwrt.org/u/ZOzo)\ **Post date:** [August 7, 2018, 5:24pm UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279/8 "2018-08-07T17:24:48Z")
> **[Wireguard - technische Diskussion](https://forum.freifunk.net/t/wireguard-technische-diskussion/13163/25)** > > wireguard erlaubt seit letzter Woche auch Kernel 3.18++ dass ist nicht nur super für Android Geräte, sondern auch für aktuelles Gluon (2016++). Die sind im Moment in der Regel noch bei ~ 3.18 Kerneln. damit kann man wireguard/gretap auch auf den... good reading here too ---
**Author:** ![ZOzo](https://forum.openwrt.org/letter_avatar/zozo/32/5_5575768a8748004e209b776fc1b2916d.png) [@ZOzo](https://forum.openwrt.org/u/ZOzo)\ **Post date:** [August 8, 2018, 6:34am UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279/9 "2018-08-08T06:34:04Z")
![wireguard-network-configv3](https://forum.openwrt.org/uploads/default/original/2X/6/6ced32be613b4a6a820243ea93f12e9e81a3f77b.gif) ---
**Author:** ![ikpo](https://forum.openwrt.org/letter_avatar/ikpo/32/5_5575768a8748004e209b776fc1b2916d.png) [@ikpo](https://forum.openwrt.org/u/ikpo)\ **Post date:** [August 11, 2018, 6:14am UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279/10 "2018-08-11T06:14:38Z")
This looks great... Can you entertain questions? ---
**Author:** ![ikpo](https://forum.openwrt.org/letter_avatar/ikpo/32/5_5575768a8748004e209b776fc1b2916d.png) [@ikpo](https://forum.openwrt.org/u/ikpo)\ **Post date:** [August 11, 2018, 6:51am UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279/11 "2018-08-11T06:51:16Z")
Can I have your code? ---
**Author:** ![ZOzo](https://forum.openwrt.org/letter_avatar/zozo/32/5_5575768a8748004e209b776fc1b2916d.png) [@ZOzo](https://forum.openwrt.org/u/ZOzo)\ **Post date:** [August 18, 2018, 4:41am UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279/12 "2018-08-18T04:41:49Z")
As per illustrative setup above: Actually no ports need to be open, Wireguard will just connect as per what is understand in the wireguard whitepaper. Lost of wireguard handshake connection when WAN IP changed on Endpoint gateway: Lan and Wireguard interface need to be restarted or the whole openwrt device will need restarting after config - after ip change on both side - after ip change on either side. WireGuard does not update Endpoint host IP automatically after the ISP provided IP changed on the endpoint. Either interface of the local device or the device itself need to be restarted. Eratic here, sometime connection is good after only LAN is restarted, sometime the WG inerface only, sometime both interface require restarting, sometime a reboot is ok and worst case a power off and power on is required. event with cron no good : \*/6 \* \* \* \* ping -4c 2 endpointhostname Device concerned here are TP-Links 1043, 4300, C2600, Archer C7, Netgear R7000 config are as such: Wireguard configured on OPENWRT endpoints OPENWRT devices possesses cron executed process to verify gateway ip changed, to update DDNS, to send mail of new ip to guy x mail and to reboot the device 10minutes after gateway ip have been changed Gateway is NOT the WG openwrt device in above config ---
**Author:** ![takimata](https://forum.openwrt.org/user_avatar/forum.openwrt.org/takimata/32/114647_2.png) [@takimata](https://forum.openwrt.org/u/takimata)\ **Post date:** [August 18, 2018, 4:58am UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279/13 "2018-08-18T04:58:32Z")
Sorry, I tried, but I can't make heads or tails of anything you wrote. ---
**Author:** ![ZOzo](https://forum.openwrt.org/letter_avatar/zozo/32/5_5575768a8748004e209b776fc1b2916d.png) [@ZOzo](https://forum.openwrt.org/u/ZOzo)\ **Post date:** [August 18, 2018, 5:08am UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279/14 "2018-08-18T05:08:44Z")
edited for heads and tails making ---
**Author:** ![takimata](https://forum.openwrt.org/user_avatar/forum.openwrt.org/takimata/32/114647_2.png) [@takimata](https://forum.openwrt.org/u/takimata)\ **Post date:** [August 18, 2018, 10:14am UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279/15 "2018-08-18T10:14:06Z")
It's not much better, really, but I'm assuming you are asking questions. > [@](#): > > WireGuard does not update Endpoint host IP automatically after the ISP provided IP changed on the endpoint. This is true, as I mentioned in a post above. However, even if both the server and the client side change IPs, none of the routers in the setup needs to be restarted. It is enough to restart the Wireguard interface on the client side OpenWrt device. Again, [there is a small "wireguard\_watchdog" script in wireguard-tools now](https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=f91a0f3b1aba95bcf3b248e02a89709ce0274fa7) to help with that. It is called on a regular basis from cron, checks if the Wireguard connection is still active, and restarts it if not. See the commit message for instructions. ---
**Author:** ![ZOzo](https://forum.openwrt.org/letter_avatar/zozo/32/5_5575768a8748004e209b776fc1b2916d.png) [@ZOzo](https://forum.openwrt.org/u/ZOzo)\ **Post date:** [August 18, 2018, 6:48pm UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279/16 "2018-08-18T18:48:03Z")
Thx Takimata, since 11 days setups has been undergoing observation and various testing, I confirm that no ports needs to be opened on either side: Facts observed here. ![wireguard-network-configv4](https://forum.openwrt.org/uploads/default/original/2X/b/bb7d0773f1d772938d165a9f80b85306d9859025.gif) ---
**Author:** ![takimata](https://forum.openwrt.org/user_avatar/forum.openwrt.org/takimata/32/114647_2.png) [@takimata](https://forum.openwrt.org/u/takimata)\ **Post date:** [August 18, 2018, 7:02pm UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279/17 "2018-08-18T19:02:51Z")
Edit: I learnt something new today. ---
**Author:** ![ZOzo](https://forum.openwrt.org/letter_avatar/zozo/32/5_5575768a8748004e209b776fc1b2916d.png) [@ZOzo](https://forum.openwrt.org/u/ZOzo)\ **Post date:** [August 18, 2018, 7:08pm UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279/18 "2018-08-18T19:08:27Z")
IP changed once on a pair of endpoints today with no ports forward on either side. Im actually logged in router 10.0.0.25 from LAN 10.0.3.0/24 right now. No opened ports related to WG on either side. ---
**Author:** ![ZOzo](https://forum.openwrt.org/letter_avatar/zozo/32/5_5575768a8748004e209b776fc1b2916d.png) [@ZOzo](https://forum.openwrt.org/u/ZOzo)\ **Post date:** [August 18, 2018, 7:15pm UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279/19 "2018-08-18T19:15:10Z")
test the setup on your side please and let me know please No open ports is the way I understand from all the WG documentations readings online, kind of upnp as both are peers. one of the docs here: [https://www.wireguard.com/quickstart/](https://www.wireguard.com/quickstart/) " NAT and Firewall Traversal Persistence By default, WireGuard tries to be as silent as possible when not being used; it is not a chatty protocol. For the most part, it only transmits data when a peer wishes to send packets. When it's not being asked to send packets, it stops sending packets until it is asked again. In the majority of configurations, this works well. However, when a peer is behind NAT or a firewall, it might wish to be able to receive incoming packets even when it is not sending any packets. Because NAT and stateful firewalls keep track of "connections", if a peer behind NAT or a firewall wishes to receive incoming packets, he must keep the NAT/firewall mapping valid, by periodically sending keepalive packets. This is called _persistent keepalives_ . When this option is enabled, a keepalive packet is sent to the server endpoint once every _interval_ seconds. A sensible interval that works with a wide variety of firewalls is 25 seconds. Setting it to 0 turns the feature off, which is the default, since most users will not need this, and it makes WireGuard slightly more chatty. This feature may be specified by adding the `PersistentKeepalive =` field to a peer in the configuration file, or setting `persistent-keepalive` at the command line. If you don't need this feature, don't enable it. But if you're behind NAT or a firewall and you want to receive incoming connections long after network traffic has gone silent, this option will keep the "connection" open in the eyes of NAT." But from basics network understanding, me too I thought ports needed to be opened. on some setups ports were opened and forwarded and on some not. So far works for both and I concluded that no ports fwd are required. With ports closed on setups where there were opened/fwdd ports, WG keep handshaking after reboots and after days online with various ISP gateway IP changed. ---
**Author:** ![ZOzo](https://forum.openwrt.org/letter_avatar/zozo/32/5_5575768a8748004e209b776fc1b2916d.png) [@ZOzo](https://forum.openwrt.org/u/ZOzo)\ **Post date:** [August 18, 2018, 7:46pm UTC](https://forum.openwrt.org/t/help-with-wireguard-please/18279/20 "2018-08-18T19:46:21Z")
Hello ikpo, thanks for your interest, actually the illustrative setup purpose is for noobs configuring via luci. All required instructions are in the illustration for such setup. Above illustration (first illustration) is not good and have been updated further below. No ports related to WireGuard connections need to be open on either remote site. Hope this help you out with your setup. [Next page](https://forum.openwrt.org/t/help-with-wireguard-please/18279.md?page=2)