Set Up a WireGuard Server on OpenWrt

This guide turns your OpenWrt router into a WireGuard server so your phone or laptop can connect to your home network from anywhere. To route your router's traffic through a VPN provider instead, see WireGuard client setup.

You will need a public IP address (or IPv6) on your router's WAN and, ideally, a dynamic DNS name. If you are behind carrier-grade NAT, incoming connections will not work.

1. Install WireGuard

# OpenWrt 25.12 and later
apk update && apk add luci-proto-wireguard qrencode

# OpenWrt 24.10 and earlier
opkg update && opkg install luci-proto-wireguard qrencode

Reboot, or restart the network with service network restart.

2. Create keys

On the router:

umask go=
wg genkey | tee server.key | wg pubkey > server.pub
wg genkey | tee phone.key | wg pubkey > phone.pub

3. Configure the interface

We use the subnet 10.0.0.0/24 for VPN clients; pick any private range not used on your LAN.

uci set network.wg0=interface
uci set network.wg0.proto='wireguard'
uci set network.wg0.private_key="$(cat server.key)"
uci set network.wg0.listen_port='51820'
uci add_list network.wg0.addresses='10.0.0.1/24'

uci add network wireguard_wg0
uci set network.@wireguard_wg0[-1].description='phone'
uci set network.@wireguard_wg0[-1].public_key="$(cat phone.pub)"
uci add_list network.@wireguard_wg0[-1].allowed_ips='10.0.0.2/32'
uci commit network

4. Firewall

Put the VPN interface in the LAN zone (so clients reach your LAN) and open UDP port 51820 on the WAN:

uci add_list firewall.@zone[0].network='wg0'   # zone 0 is "lan" in the default config

uci add firewall rule
uci set firewall.@rule[-1].name='Allow-WireGuard'
uci set firewall.@rule[-1].src='wan'
uci set firewall.@rule[-1].dest_port='51820'
uci set firewall.@rule[-1].proto='udp'
uci set firewall.@rule[-1].target='ACCEPT'
uci commit firewall

service network restart
service firewall restart

Check with uci show firewall.@zone[0].name that zone 0 is really lan before running the first command.

5. Client configuration

Create this file for your phone and import it into the WireGuard app (or show it as a QR code with qrencode -t ansiutf8 < phone.conf):

[Interface]
PrivateKey = <contents of phone.key>
Address = 10.0.0.2/32
DNS = 192.168.1.1

[Peer]
PublicKey = <contents of server.pub>
Endpoint = your-ddns-name.example.net:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

AllowedIPs = 0.0.0.0/0, ::/0 sends all the phone's traffic through home. To reach only your home network, use your LAN subnet instead, for example 192.168.1.0/24, 10.0.0.0/24.

Delete the private key files from the router once you are done (rm phone.key).

Adding more devices

Generate a new key pair per device and add another wireguard_wg0 peer with the next address (10.0.0.3/32, …). Never share keys between devices.

Troubleshooting

• wg show lists peers and the time of the last handshake.
• No handshake at all usually means the port is not reachable: check the firewall rule and whether your ISP gives you a public IP.