# \[Solved\] Wireguard as a VPN "server" **URL:** \ **Category:** Installing and Using OpenWrt\ **Created:** [October 19, 2017, 5:34pm UTC](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635 "2017-10-19T17:34:38Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![fsclavo](https://forum.openwrt.org/user_avatar/forum.openwrt.org/fsclavo/32/2088_2.png) [@fsclavo](https://forum.openwrt.org/u/fsclavo)\ **Post date:** [October 19, 2017, 5:34pm UTC](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635/1 "2017-10-19T17:34:38Z")
I'm trying to build a VPN server on my Lede router, using Wireguard. I know that there is no "server" and "clients" on wireguard, just peers, and I have a few questions: 1. How IP addresses are managed? router (let's name it peer 1 on wireguard) normally has a dhcp wan address, which can change, and my notebook (peer 2) will have an unknown IP address depending where I connect it. Looking at this guide: [https://danrl.com/blog/2017/luci-proto-wireguard/](https://danrl.com/blog/2017/luci-proto-wireguard/) we need an IP address for the wireguard interface (can I use the router DynDNS hostname?) and for peers is an endpoint host totally unkown before connecting, can I use some kind of wildcard here? 2. Firewall: it's recommended to set up a separated zone or include the new wireguard interface on LAN zone? Thanks in advance ---
**Author:** ![RangerZ](https://forum.openwrt.org/letter_avatar/rangerz/32/5_5575768a8748004e209b776fc1b2916d.png) [@RangerZ](https://forum.openwrt.org/u/RangerZ)\ **Post date:** [October 19, 2017, 8:54pm UTC](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635/2 "2017-10-19T20:54:57Z")
I have been trying to digest the above as well as the Wiregaurd site and was wondering the same. [https://www.wireguard.com/](https://www.wireguard.com/) Seems ok for a peer to peer set up but also not clear on how to do a Road Warrior setup ---
**Author:** ![fsclavo](https://forum.openwrt.org/user_avatar/forum.openwrt.org/fsclavo/32/2088_2.png) [@fsclavo](https://forum.openwrt.org/u/fsclavo)\ **Post date:** [October 20, 2017, 1:59pm UTC](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635/3 "2017-10-20T13:59:53Z")
Exactly, it looks more like a fixed site to site VPN ---
**Author:** ![lleachii](https://forum.openwrt.org/letter_avatar/lleachii/32/5_5575768a8748004e209b776fc1b2916d.png) [@lleachii](https://forum.openwrt.org/u/lleachii)\ **Post date:** [October 20, 2017, 2:36pm UTC](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635/4 "2017-10-20T14:36:12Z")
I literally set this up yesterday to see how easy it could be: 1. IPs are managed by the kernels on either side. Therefore, you must use the correct CIDR prefix on the interfaces on both ends. **(e.g. for a 2-peer configuration, you must use at least a /31 or /30 at the router-side of your traffic, the "client-end" can use the other available /32 in that subnet).** 2. I found a need to setup a different zone. The rules are different between networks, etc.; but this is solely your choice, considering the trust of the network on the "far end." - **_VERY IMPORTANT - to use the connection as a VPN Internet connection, the CLIENT must allow IPs 0.0.0.0/0 or the following two routes combined (in order to override the since default 0/0): 0.0.0.0/1 and 128.0.0.0/1._** For this reason alone, you may wish to use a different firewall zone. - Once configured, they behave like a unicast IP tunnel - If your remote end is the server, ensure you set up IP forwarding and masquerade - The LEDE device is already a router, so you would setup everything as a normal 2nd WAN - On LEDE, you would add the interface to a Firewall Zone, add masquerading, etc. - On a road warrior setup, you configure the peer in LEDE not to have an endpoint IP, with the LEDE having no endpoint IP, your client device can dynamically connect to your LEDE router as it roams. See: [https://www.wireguard.com/#built-in-roaming](https://www.wireguard.com/#built-in-roaming) Hope this helps. ---
**Author:** ![fsclavo](https://forum.openwrt.org/user_avatar/forum.openwrt.org/fsclavo/32/2088_2.png) [@fsclavo](https://forum.openwrt.org/u/fsclavo)\ **Post date:** [January 5, 2018, 6:12pm UTC](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635/5 "2018-01-05T18:12:33Z")
Sorry for the delay @lleachii, thanks a lot for your help, it works great! ---
**Author:** ![lleachii](https://forum.openwrt.org/letter_avatar/lleachii/32/5_5575768a8748004e209b776fc1b2916d.png) [@lleachii](https://forum.openwrt.org/u/lleachii)\ **Post date:** [January 5, 2018, 6:24pm UTC](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635/6 "2018-01-05T18:24:23Z")
Excellent. Consider editing the thread's title to note it as "Solved." ---
**Author:** ![Pedro](https://forum.openwrt.org/user_avatar/forum.openwrt.org/pedro/32/38503_2.png) [@Pedro](https://forum.openwrt.org/u/Pedro)\ **Post date:** [February 7, 2018, 3:19pm UTC](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635/7 "2018-02-07T15:19:18Z")
Can you share the configuration for both the server and client? wireguard, iptables, etc ) I can create a lan to lan configuration with no problems, but I wasn't able to do a rogue-warrior config. ---
**Author:** ![lleachii](https://forum.openwrt.org/letter_avatar/lleachii/32/5_5575768a8748004e209b776fc1b2916d.png) [@lleachii](https://forum.openwrt.org/u/lleachii)\ **Post date:** [February 7, 2018, 4:05pm UTC](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635/8 "2018-02-07T16:05:16Z")
> [@Pedro](#): > > Can you share the configuration for both the server and client? wireguard, iptables, etc ) Server (Ubuntu): ``` #SETUP TUNNEL sudo ip link add dev wg0 type wireguard sudo ip address add dev wg0 192.168.245.1/30 **#NEXT LINE HAS NO PEER HOST/PORT, IT'S CONFIGURED FOR ROAMING** sudo wg set wg0 listen-port 48888 private-key peer allowed-ips 192.168.245.2/32 sudo ip link set up dev wg0 #TO SETUP ROUTING AND NAT FOR PEER sudo sysctl -w net.ipv4.ip_forward=1 sudo iptables -t nat -A POSTROUTING -s 192.168.245.2 -j MASQUERADE ``` /etc/config/network ``` config interface 'test_wireguard' option proto 'wireguard' option listen_port '49999' list addresses '192.168.245.2/32' option private_key '' config wireguard_test_wireguard option public_key '' list allowed_ips '0.0.0.0/0' option endpoint_host '' option endpoint_port '48888' #YOU MAY NEED TO ADD ROUTES AS WELL ``` /etc/config/firewall ``` config rule option target 'ACCEPT' option src 'wan' option proto 'udp' option name 'Wireguard_VPN' option family 'ipv4' option dest_port '49999' ``` > [@Pedro](#): > > but I wasn’t able to do a rogue-warrior config The only difference on a mobile config is that you don't specify the peer's IP/host/port on the server. Also see: [https://www.wireguard.com/#simple-network-interface](https://www.wireguard.com/#simple-network-interface) ---
**Author:** ![Mushoz](https://forum.openwrt.org/user_avatar/forum.openwrt.org/mushoz/32/49821_2.png) [@Mushoz](https://forum.openwrt.org/u/Mushoz)\ **Post date:** [March 9, 2018, 10:05am UTC](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635/9 "2018-03-09T10:05:16Z")
Thank you very much for all the pointers in this thread. I've managed to get this up and running 🙂 I am planning to write an extensive guide on how to use a roaming Wireguard setup on the Wiki. I do have a few questions that can hopefully be answered before I start writing one, because I am not 100% happy with the current setup at the moment. The first thing I am not happy about is the fact that I have to specify an IP address for each individual client. Would it be possible to fetch an IP address from a DHCP server on the router, so that I don't have to specify an IP manually on all of my clients (And make sure they all have a unique one)? The second thing I don't really like is the fact that I have to add peers on the router as well. Would it be possible to use Wireguard in which the public key is sent from the client to the server by encrypting it with the server's public key? In that sense, the server's public key should remain confidential as well, since having that would allow anyone to connect to the VPN. As an extra layer of security a preshared key could be applied as well. This way, I can connect to the VPN with a new client, without have access to the VPN in the first place to add this new peer to the list. This would increase the versatility of the setup in my opinion. ---
**Author:** ![mikma](https://forum.openwrt.org/letter_avatar/mikma/32/5_5575768a8748004e209b776fc1b2916d.png) [@mikma](https://forum.openwrt.org/u/mikma)\ **Post date:** [March 9, 2018, 2:16pm UTC](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635/10 "2018-03-09T14:16:35Z")
> [@Mushoz](#): > > The second thing I don't really like is the fact that I have to add peers on the router as well. Would it be possible to use Wireguard in which the public key is sent from the client to the server by encrypting it with the server's public key? In that sense, the server's public key should remain confidential as well, since having that would allow anyone to connect to the VPN. As an extra layer of security a preshared key could be applied as well. I doesn't make sense to me. You should create another key pair, lets call it the admin key pair. Sign the request containing the public key of the client with the private key of the admin. The server can then verify the signature by using the public key of the admin. Of course this all needs to happen out of band using a rest request or similar. ---
**Author:** ![Mushoz](https://forum.openwrt.org/user_avatar/forum.openwrt.org/mushoz/32/49821_2.png) [@Mushoz](https://forum.openwrt.org/u/Mushoz)\ **Post date:** [March 10, 2018, 5:50am UTC](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635/11 "2018-03-10T05:50:19Z")
Yes, and the out of band is the thing I do not like. I have to manually add clients' public keys to the server or set-up a REST API in order to do so. I would prefer if I could from any device anywhere from the world as long as I have the server's public key and the preshared key. Also, do you happen to know whether it is possible to use DHCP to fetch an IP address instead of having to use static IPs defined in the config files of Wireguard? ---
**Author:** ![mikma](https://forum.openwrt.org/letter_avatar/mikma/32/5_5575768a8748004e209b776fc1b2916d.png) [@mikma](https://forum.openwrt.org/u/mikma)\ **Post date:** [March 10, 2018, 7:05pm UTC](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635/12 "2018-03-10T19:05:45Z")
> [@Mushoz](#): > > Yes, and the out of band is the thing I do not like. I have to manually add clients' public keys to the server or set-up a REST API in order to do so. I would prefer if I could from any device anywhere from the world as long as I have the server's public key and the preshared key. Actually I think it may be possible to do dynamic address assignment in-band by using IPv6 link-local IP addresses. IP6 Link-local addresses uses the subnet fe80::/64, and are usually based on the MAC address. But I guess it should be possible to instead derive the 64 bit interface identity from the public key. IPv6 link-local addresses are used by DHCPv6 which means it may work. A DHCPv6 server uses the address ff02::1:2 in addition to the link-local address derived from its public key, but it shouldn't be a problem since. IPv4 is another matter. > [@Mushoz](#): > > Also, do you happen to know whether it is possible to use DHCP to fetch an IP address instead of having to use static IPs defined in the config files of Wireguard? I don't think DHCPv4 is possible since the client uses address 0.0.0.0, which means only one wireguard peer would be possible. Edit: I have verified that DHCPv6 including prefix delegation can be made to work with wireguard. But I don't know useful it is. For example It's harder to write an android app using DHCPv6 than a REST API. ---
**Author:** ![craz](https://forum.openwrt.org/letter_avatar/craz/32/5_5575768a8748004e209b776fc1b2916d.png) [@craz](https://forum.openwrt.org/u/craz)\ **Post date:** [April 25, 2018, 4:35pm UTC](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635/13 "2018-04-25T16:35:54Z")
> [@Mushoz](#): > > I am planning to write an extensive guide on how to use a roaming Wireguard setup on the Wiki. Hi, can you please tell me where I find guide? Thanks ---
**Author:** ![Mushoz](https://forum.openwrt.org/user_avatar/forum.openwrt.org/mushoz/32/49821_2.png) [@Mushoz](https://forum.openwrt.org/u/Mushoz)\ **Post date:** [April 25, 2018, 4:54pm UTC](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635/14 "2018-04-25T16:54:01Z")
I haven't found the time yet to write this guide. It's definitely still on my to-do list. ---
**Author:** ![huaracheguarache](https://forum.openwrt.org/user_avatar/forum.openwrt.org/huaracheguarache/32/2580_2.png) [@huaracheguarache](https://forum.openwrt.org/u/huaracheguarache)\ **Post date:** [May 14, 2018, 8:52am UTC](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635/15 "2018-05-14T08:52:48Z")
I would also really appreciate if you wrote a guide. There are a lot of things I would like to know how to do properly, such as in which firewall zone to place the WireGuard interface. ---
**Author:** ![craz](https://forum.openwrt.org/letter_avatar/craz/32/5_5575768a8748004e209b776fc1b2916d.png) [@craz](https://forum.openwrt.org/u/craz)\ **Post date:** [June 12, 2018, 4:39pm UTC](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635/16 "2018-06-12T16:39:05Z")
I tried everything but I can not configure a vpn road warrior with android, surely I'm wrong in the firewall configuration 😭 Can someone post a working configuration? Thank you ---
**Author:** ![lleachii](https://forum.openwrt.org/letter_avatar/lleachii/32/5_5575768a8748004e209b776fc1b2916d.png) [@lleachii](https://forum.openwrt.org/u/lleachii)\ **Post date:** [June 12, 2018, 5:44pm UTC](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635/17 "2018-06-12T17:44:18Z")
> [@craz](#): > > Can someone post a working configuration? My configuration above does work: **See Post # 7** > [@\[Solved\] Wireguard as a VPN "server"](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635/7): > > Can you share the configuration for both the server and client? wireguard, iptables, etc ) I can create a lan to lan configuration with no problems, but I wasn't able to do a rogue-warrior config. Been working since October, 2017. > [@craz](#): > > surely I'm wrong in the firewall configuration 😭 Perhaps, you should post your config, instead. Also, the OP was able to get his Wireguard working. Perhaps you should create new thread, as this one has been marked as **[SOLVED].** ---
**Author:** ![tmomas](https://forum.openwrt.org/letter_avatar/tmomas/32/5_5575768a8748004e209b776fc1b2916d.png) [@tmomas](https://forum.openwrt.org/u/tmomas)\ **Post date:** [June 15, 2018, 5:44pm UTC](https://forum.openwrt.org/t/solved-wireguard-as-a-vpn-server/7635/18 "2018-06-15T17:44:21Z")
This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.