Setup wireguard VPN server on OpenWrt

[tommiedepommie]

For those interested in my mixture howto setup WireGuard VPN server on openwrt with an Android client

1) install packages via software o r opkg

open de configuration page of your router in a browser:

http://192.168.8.1

Log in the Luci interface with your root account and password.

Goto system-->software and click on ‘update lists’

after the list is loaded click on ‘dismiss’

Enter ‘wireguard’ in the Filter field and press ‘enter’

Install:

wireguard

wireguard-tools

kmod-wireguard

luci-app-wireguard

or via OPKG

Install packages

opkg update

opkg install wireguard

1a) configure variables

access router via ssh or putty

ssh root@192.168.8.1

use same root credentials to login router

copy next lines on commandline :

WG_IF="wg0"

WG_PORT="51820"

WG_ADDR="192.168.9.1/24"

WG_ADDR6="fdf1:e8a1:8d3f:9::1/64"

2) Gener ate security keys

copy next lines on commandline :

cd /etc / config

umask go=

wg genkey | tee wgserver.key | wg pubkey > wgserver.pub

wg genpsk > wg.psk

WG_KEY="$(cat wgserver.key)"

WG_PSK="$(cat wg.psk)"

WG_PUB="$(cat wgclient.pub)"

remark:

wg.psk = Pre-Shared-key

wgserver.key = Private server Key

wgclient.pub = Public Key from client

3) Set FireWall

copy next lines on commandline :

uci rename firewall.@zone[0]="lan"

uci rename firewall.@zone[1]="wan"

uci rename firewall.@forwarding[0]="lan_wan"

uci del_list firewall.lan.network="${WG_IF}"

uci add_list firewall.lan.network="${WG_IF}"

uci -q delete firewall.wg

uci set firewall.wg="rule"

uci set firewall.wg.name="Allow-WireGuard"

uci set firewall.wg.src="wan"

uci set firewall.wg.dest_port="${WG_PORT}"

uci set firewall.wg.proto="udp"

uci set firewall.wg.target="ACCEPT"

uci commit firewall

/etc/init.d/firewall restart

3a) port forwarder wireguard

In Luci webinterface goto :

Network->Firewall->Port Forwards

Name: WireGuard

Protocol: UDP

External Zone: WAN

External Port: 51820

Internal Zone: LAN

Internal IP Address: <The IP address of your device, mine is 192.168.8.1>

Internal Port: 51820

save & apply

4) Install interface and Peer

copy next lines on commandline :

uci -q delete network.${WG_IF}

uci set network.${WG_IF}="interface"

uci set network.${WG_IF}.proto="wireguard"

uci set network.${WG_IF}.private_key="${WG_KEY}"

uci set network.${WG_IF}.listen_port="${WG_PORT}"

uci add_list network.${WG_IF}.addresses="${WG_ADDR}"

uci add_list network.${WG_IF}.addresses="${WG_ADDR6}"

and

uci -q delete network.wgclient

uci set network.wgclient="wireguard_${WG_IF}"

uci set network.wgclient.public_key="${WG_PUB}"

uci set network.wgclient.preshared_key="${WG_PSK}"

uci add_list network.wgclient.allowed_ips="${WG_ADDR%.*}.2/32"

uci add_list network.wgclient.allowed_ips="${WG_ADDR6%:*}:2/128"

uci commit network

/etc/init.d/network restart

5) Install WireGuard on Android

Install wireguard frpm play store

Open wireguard app and tap on ‘+’ to ‘create from scratch’

a) Name your VPN connection

b) in the addresses field enter an ipaddress pa : 192.168.8.2/32

ofcourse in the same ip-range as you used in 1a.

But keep the /32

c) In DNS field you can enter your own DNS or a public one, 192.168.8.1 or 1.1.1.1 or 8.8.8.8

d) Click on ‘Add Peer’

e) paste the public server key (wgserver.pub) generated in the public key field of the Peer.

f) remove the pre-shared key

g) Set ‘persistent keepalive’ on 25

h) Enter the DDNS address of your router WITH portnumber pa:

‘router001.duckdns.org:51820’

i) Enter ‘0.0.0.0/0,::0’ in the ‘Allowed IPs’ field.

j) click on ‘save’ in the upper right corner.

6) Add phone to list of allowed peers.

a) open the wireguard app on your phone.

b) copy the Public Key from ‘Interface’ to clipboard

c) open Luci in a webbrowser and go to

Network→Interfaces

Click on Edit

Click on tab Peers and click on ‘Add’

d) Paste the public key from your phone into the Public key field in Luci.

e) Enter ‘192.168.9.2/32’ into Allowed Ips field.

f) check ‘Route Allowed Ips’

g) Leave Endpoint host and port empty

h) Enter ‘25’ in ‘Persistent Keep Alive’ field

Save and Save & Apply

Reboot router.

PS: Please let me know if I made an error somewhere.
PS2: I used Lastpass notes to exchange the keys

[trendy]

What was the error? The file is created just fine:

root@magiatiko:[/tmp]#cd test
root@magiatiko:[/tmp/test]#umask go=
root@magiatiko:[/tmp/test]#wg genkey | tee wgserver.key | wg pubkey > wgserver.pub
root@magiatiko:[/tmp/test]#wg genpsk > wg.psk
root@magiatiko:[/tmp/test]#la
drwxr-xr-x    2 root     root         100 Sep 25 16:08 ./
drwxrwxrwt   26 root     root         900 Sep 25 16:08 ../
-rw-------    1 root     root          45 Sep 25 16:08 wg.psk
-rw-------    1 root     root          45 Sep 25 16:08 wgserver.key
-rw-------    1 root     root          45 Sep 25 16:08 wgserver.pub

[krazeh]

The file creates fine, but the instructions then reference 'wgclient.pub' rather than 'wgserver.pub' (WG_PUB="$(cat wgclient.pub)") so you get an error.

[tommiedepommie]

The original key generation from: https://openwrt.org/docs/guide-user/services/vpn/wireguard/basic is:

Generate and exchange the keys

umask go=
wg genkey | tee wgserver.key | wg pubkey > wgserver.pub
wg genpsk > wg.psk

WG_KEY="$(cat wgserver.key)"
WG_PSK="$(cat wg.psk)"
WG_PUB="$(cat wgclient.pub)"

In the last line is says "cat wgclient.pub" but this file is never created.

[tommiedepommie]

exactly

[krazeh]

@tommiedepommie

In the last line is says "cat wgclient.pub" but this file is never created.

Having looked at the wiki I think it's intended that you copy the wgclient.pub file from a different device before running those commands, but it's not very clear in the way it's worded.

[trendy]

I edited a bit so I hope it is clear now.