Follow this guide to set up WireGuard on your OpenWrt router
Connect to your OpenWrt router via SSH and install the required packages:
# Update package lists
opkg update
# Install WireGuard packages
opkg install wireguard-tools luci-app-wireguard
# For kernel module (if not included)
opkg install kmod-wireguard
luci-app-wireguard
package provides a web interface for WireGuard configuration.
# Check if WireGuard module is loaded
lsmod | grep wireguard
# Check WireGuard version
wg --version
Download your WireGuard configuration from the GetIP.online dashboard.
Create the WireGuard interface configuration:
# Add WireGuard interface to network config
uci set network.wg0=interface
uci set network.wg0.proto='wireguard'
uci set network.wg0.private_key='YOUR_PRIVATE_KEY_HERE'
uci add_list network.wg0.addresses='YOUR_IPV6_ADDRESS_HERE/128'
# Add peer configuration
uci add network wireguard_wg0
uci set network.@wireguard_wg0[-1]=wireguard_wg0
uci set network.@wireguard_wg0[-1].public_key='SERVER_PUBLIC_KEY_HERE'
uci set network.@wireguard_wg0[-1].endpoint_host='SERVER_ENDPOINT_HERE'
uci set network.@wireguard_wg0[-1].endpoint_port='51820'
uci set network.@wireguard_wg0[-1].allowed_ips='::/0'
uci set network.@wireguard_wg0[-1].persistent_keepalive='25'
# Commit changes
uci commit network
# Add WireGuard to WAN zone
uci add firewall zone
uci set firewall.@zone[-1].name='wg'
uci set firewall.@zone[-1].network='wg0'
uci set firewall.@zone[-1].forward='ACCEPT'
uci set firewall.@zone[-1].masq='1'
uci set firewall.@zone[-1].mtu_fix='1'
# Allow forwarding from LAN to WireGuard
uci add firewall forwarding
uci set firewall.@forwarding[-1].src='lan'
uci set firewall.@forwarding[-1].dest='wg'
# Commit firewall changes
uci commit firewall
Alternatively, configure through the LuCI web interface:
http://192.168.1.1
)wg0
and select WireGuard VPN as protocolluci
package is installed and the web server is running.
Activate the WireGuard interface and verify connectivity:
# Restart network service
/etc/init.d/network restart
# Check interface status
ifstatus wg0
# Check WireGuard status
wg show
# Test from router
ping6 google.com
# Check IPv6 routing
ip -6 route show
# Monitor WireGuard traffic
wg show wg0 transfer
Enable IPv6 forwarding for your LAN devices:
# Enable IPv6 forwarding
uci set network.lan.ip6assign='60'
uci commit network
# In /etc/sysctl.conf, ensure:
net.ipv6.conf.all.forwarding=1
Configure IPv6 DNS servers:
# Add IPv6 DNS servers
uci add_list network.wg0.dns='2001:4860:4860::8888'
uci add_list network.wg0.dns='2001:4860:4860::8844'
uci commit network
Adjust MTU for optimal performance:
# Set MTU (usually 1420 for WireGuard)
uci set network.wg0.mtu='1420'
uci commit network
logread | grep wireguard
iptables -L -n -v
/etc/init.d/odhcpd status
top
# Show WireGuard configuration
wg showconf wg0
# Monitor real-time stats
watch -n 1 'wg show wg0 transfer'
# Restart WireGuard interface
ifdown wg0 && ifup wg0
# Check routing table
ip -6 route show table all
Your OpenWrt router is now routing IPv6 traffic through GetIP.online. All devices on your network can now access IPv6 resources.