Installing WireGuard on routers running OpenWrt and LuCI

Installing the LuCI WireGuard package

1. Connect to the LuCI administration interface through the browser of your choice. Usually its address is 192.168.1.1.

2. In the menu bar, hover on System > click on Software.

3. In the Download and install package field, enter luci-proto-wireguard > click on OK to install WireGuard and all necessary dependencies.

Generating the keys pair

1. Connect onto the router by typing in a console:

   ssh root@192.168.1.1

   Show optional steps

   Create a directory to store the keys. You can replace wgkeys with the name of your choice.

   mkdir wgkeys && cd wgkeys

2. Generate the keys with the following command:

   wg genkey | tee privatekey | wg pubkey > publickey

3. Display the keys with the following commands, you will need them later:

   cat privatekey && cat publickey

Contacting AzireVPN API to get connection details

1. It is necessary to install ca-bundle and curl in order to contact AzireVPN API, using the following commands:

   opkg update
   opkg install ca-bundle curl

2. Contact the API to get connection details with the following command, you will need them later. Replace se1 in the API URL by the two letters code of the location you desire to connect to. You can find the codes in the hostname of our WireGuard endpoints on the Status page:

   curl -d list=1 -d username=REPLACE --data-urlencode password=REPLACE --data-urlencode pubkey=REPLACE https://api.azirevpn.com/v1/wireguard/connect/se1

Creating the WireGuard interface

1. In the menu bar, hover on Network > click on Interfaces.

2. In the Global network options section, in the IPv6 ULA-Prefix field, enter the IPv6 prefix delegation subnet and the IPv6 prefix delegation netmask returned earlier by the API, available under the ipv6_pd_subnet and the ipv6_pd_netmask fields. When entered, the final address should be of the form 0:0:0:0::/0.

3. Click on Save & Apply.

4. Click on Add new interface…

5. In the Name of the new interface field, enter wg.

6. In the Protocol of the new interface list, select WireGuard VPN > click on Submit

Configuring the WireGuard interface

1. In the Common Configuration section, in the Private Key field, enter the private key you generated earlier.

2. In the IP Addresses field, enter the IPv4 private address and netmask returned earlier by the API, available under the ipv4_addr and ipv4_addr_netmask fields. The IP address should be in the form 10.0.0.0/0.

3. Next to the IP Addresses field, click on + to add a new field.

4. In the newly created field, enter the IPv6 public address and netmask returned earlier by the API, available under the ipv6_addr and ipv6_addr_netmask fields. The IP address should be in the form 0:0:0:0::0/0.

5. In the Peers section, click on Add.

6. In the Public Key field, enter the public key of the WireGuard endpoint returned earlier by the API, available under the endpoint_pubkey field.

7. In the Allowed IPs field, enter 0.0.0.0/0.

8. Next to the Allowed IPs field, click on + to add a new field.

9. In the newly created field, enter ::/0.

10. Check the Route Allowed IPs box.

11. In the Endpoint Host field, enter the IPv4 hostname of the WireGuard endpoint returned earlier by the API, available under the endpoint_ipv4_addr field. If your ISP supports IPv6 natively, you can choose to use the IPv6 hostname of the endpoint instead, available under the endpoint_ipv6_addr field.

12. In the Endpoint Port field, enter the port number of the WireGuard endpoint returned earlier by the API, available under the endpoint_ipv4_port field. If your ISP supports IPv6 natively, you can choose to use the IPv6 port of the endpoint instead, available under the endpoint_ipv6_port field.

13. Click on Save & Apply.

Configuring the firewall

1. In the menu bar, hover on Network > click on Firewall.

2. In the Zones section, click on Add.

3. In the Zone "newzone" section, in the Name field, enter wgzone.

4. In the Input list, select Reject.

5. Check the Masquerading box.

6. Check the MSS clamping box.

7. In the Covered Networks list, check wg.

8. Click on Save & Apply.

9. In the Zones section, in the lan ⇒ wan zone line, click on Edit.

10. In the Inter-Zone Forwarding section, in the Allow forward to destination zones list, uncheck wan then check wgzone

11. Click on Save & Apply.

Configuring the DNS servers

1. In the menu bar, hover on Network > click on Interfaces.

2. In the Interfaces section, in the WAN interface line, click on Edit.

3. In the Common Configuration section, click on the Advanced Settings tab.

4. Uncheck the Use DNS servers advertised by peer box.

5. In the Use custom DNS servers field, enter the IPv4 address for the chosen location.

6. Click on Save.

7. In the tab bar below the menu bar, click on WAN6.

8. In the Common Configuration section, click on the Advanced Settings tab.

9. Uncheck the Use DNS servers advertised by peer box.

10. In the Use custom DNS servers field, enter the IPv6 address for the chosen location.

11. Click on Save & Apply.

Rebooting the router

1. In the menu bar, hover on System > click on Reboot.

2. Click on Perform reboot.

3. Wait some minutes for the reboot to be effective and the WireGuard interface to be up and running.

4. Connect to the LuCI administration interface.

5. In the menu bar, hover on System > click on System.

6. In the System Properties section, click on the Sync with browser button. The router needs to be synced to perform the connection as WireGuard is time sensitive. This step must be done each time the router is rebooted.

7. You can check the connection to our service on the Check page.