How to Configure WireGuard on OpenWrt (VPN Client)

This guide connects your OpenWrt router to a VPN provider using WireGuard, so every device on your network uses the VPN without installing anything. It works with any provider that gives you a WireGuard configuration file; see our guides for Proton VPN and NordVPN for how to get one.

What you need

• A router with enough CPU for encryption at your connection speed. Check the WireGuard suitability on its router page.
• A WireGuard configuration from your provider. It looks like this:

[Interface]
PrivateKey = <your private key>
Address = 10.2.0.2/32
DNS = 10.2.0.1

[Peer]
PublicKey = <server public key>
AllowedIPs = 0.0.0.0/0
Endpoint = 203.0.113.10:51820

1. Install WireGuard support

# OpenWrt 25.12 and later
apk update && apk add luci-proto-wireguard

# OpenWrt 24.10 and earlier
opkg update && opkg install luci-proto-wireguard

Then reboot (or run service network restart) so LuCI shows the new protocol.

2. Create the interface

In LuCI: Network → Interfaces → Add new interface, name it vpn, protocol WireGuard VPN. On the General Settings tab use Load configuration… to import your provider's file, or fill in the private key and the address by hand. On the Peers tab, check that the peer has Route Allowed IPs enabled.

Or over SSH, replacing the values from your file:

uci set network.vpn=interface
uci set network.vpn.proto='wireguard'
uci set network.vpn.private_key='YOUR_PRIVATE_KEY'
uci add_list network.vpn.addresses='10.2.0.2/32'

uci add network wireguard_vpn
uci set network.@wireguard_vpn[-1].public_key='SERVER_PUBLIC_KEY'
uci set network.@wireguard_vpn[-1].endpoint_host='203.0.113.10'
uci set network.@wireguard_vpn[-1].endpoint_port='51820'
uci add_list network.@wireguard_vpn[-1].allowed_ips='0.0.0.0/0'
uci set network.@wireguard_vpn[-1].route_allowed_ips='1'
uci set network.@wireguard_vpn[-1].persistent_keepalive='25'
uci commit network

3. Firewall zone

The tunnel gets its own zone with masquerading, and LAN is allowed to forward into it:

uci add firewall zone
uci set firewall.@zone[-1].name='vpn'
uci set firewall.@zone[-1].input='REJECT'
uci set firewall.@zone[-1].output='ACCEPT'
uci set firewall.@zone[-1].forward='REJECT'
uci set firewall.@zone[-1].masq='1'
uci set firewall.@zone[-1].mtu_fix='1'
uci add_list firewall.@zone[-1].network='vpn'

uci add firewall forwarding
uci set firewall.@forwarding[-1].src='lan'
uci set firewall.@forwarding[-1].dest='vpn'
uci commit firewall

service network restart
service firewall restart

4. DNS

To stop DNS queries from going to your ISP, use the provider's DNS server through the tunnel:

uci set network.wan.peerdns='0'
uci add_list network.vpn.dns='10.2.0.1'   # the DNS address from your config
uci commit network
service network restart

5. Check it works

• wg show should list a recent handshake.
• From a device on your LAN, visit an IP-check site: it should show the VPN server's location.

If the tunnel drops, devices fall back to your normal connection. To block traffic instead, set up a kill switch. To send only some devices through the VPN, see policy-based routing.