WireGuard Server - GL.iNet Docs

Setup WireGuard Server on GL.iNet router¶ ... WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be ... Skiptocontent Home Specification Setup Tutorials Troubleshooting Development GL.iNetDocs gl-inet/docs3.x Home Home Overview Specification Specification ModelCategory GL-AR150(White) GL-AR300M(Shadow) GL-MT300N-V2(Mango) GL-AR750(Creta) GL-AR750S-EXT(Slate) GL-MT1300(Beryl) GL-SFT1200(Opal) GL-AX1800(Flint) GL-AXT1800(SlateAX) GL-A1300(SlatePlus) GL-MiFi GL-XE300(Puli) GL-X750(Spitz) GL-E750(Mudi) GL-USB150(Microuter) GL-B1300(Convexa-B) GL-S1300(Convexa-S) GL-MV1000(Brume) GL-MV1000W(Brume-W) GL-X1200(Amarok) GL-X300B(Collie) GL-S10 GL-AP1300(Cirrus) GL-B2200(Velica) GL-SF1200 microuter-N300 VIXMINI DominoCore GL-MT300A GL-MT300N Setup Setup ModelCategory MiniRouterSeries MiniRouterSeries FirstTimeSetup Internet Wireless Clients Upgrade Firewall VPN Applications MoreSettings GL-AR750(Creta) GL-AR750(Creta) FirstTimeSetup Internet Wireless Clients Upgrade Firewall VPN Applications MoreSettings GL-AR750S-EXT(Slate) GL-AR750S-EXT(Slate) FirstTimeSetup Internet Wireless Clients Upgrade Firewall VPN Applications MoreSettings GL-MT1300(Beryl) GL-MT1300(Beryl) FirstTimeSetup Internet Wireless Clients Upgrade Firewall VPN Applications MoreSettings GL-SFT1200(Opal) GL-SFT1200(Opal) FirstTimeSetup Internet Wireless Clients Upgrade Firewall VPN Applications MoreSettings GL-AX1800(Flint) GL-AX1800(Flint) FirstTimeSetup Internet Wireless Clients Upgrade Firewall VPN Applications MoreSettings GL-AXT1800(SlateAX) GL-A1300(SlatePlus) GL-MiFi GL-MiFi FirstTimeSetup Internet Wireless Clients Upgrade Firewall VPN Applications MoreSettings GL-XE300(Puli) GL-XE300(Puli) FirstTimeSetup Internet Wireless Clients Upgrade Firewall VPN Applications MoreSettings GL-X750(Spitz) GL-X750(Spitz) FirstTimeSetup Internet Wireless Clients Upgrade Firewall VPN Applications MoreSettings GL-E750(Mudi) GL-E750(Mudi) FirstTimeSetup Internet Wireless Clients Upgrade Firewall VPN Applications MoreSettings GL-USB150(Microuter) GL-USB150(Microuter) FirstTimeSetup Internet Wireless Clients Upgrade Firewall VPN Applications MoreSettings GL-B1300(Convexa-B) GL-B1300(Convexa-B) FirstTimeSetup Internet Wireless Mesh Clients Upgrade Firewall VPN Applications MoreSettings GL-S1300(Convexa-S) GL-S1300(Convexa-S) FirstTimeSetup Internet Wireless Mesh Clients Upgrade Firewall VPN Applications MoreSettings GL-B2200(Velica) GL-B2200(Velica) FirstTimeSetup Internet Mesh/Wireless Clients Upgrade Firewall VPN Applications MoreSettings GL-MV1000(Brume) GL-MV1000(Brume) FirstTimeSetup Internet Wireless Clients Upgrade Firewall VPN Applications MoreSettings GL-MV1000W(Brume-W) GL-MV1000W(Brume-W) FirstTimeSetup Internet Wireless Clients Upgrade Firewall VPN Applications MoreSettings GL-SF1200 GL-SF1200 FirstTimeSetup Internet Wireless Clients Upgrade Firewall VPN Applications MoreSettings GL-X1200(Amarok) GL-X1200(Amarok) FirstTimeSetup GL-X300B(Collie) GL-X300B(Collie) FirstTimeSetup GL-S10 GL-S10 FirstTimeSetup UserManual FirmwareComplilationGuide GL-AP1300/GL-AP1300LTE(Cirrus) GL-AP1300/GL-AP1300LTE(Cirrus) FirstTimeSetup Internet Wireless Clients Upgrade Firewall VPN Applications MoreSettings microuter-N300 microuter-N300 FirstTimeSetup Internet Wireless Clients Upgrade Firewall VPN Applications MoreSettings VIXMINI VIXMINI FirstTimeSetup Internet Wireless Clients Upgrade Applications MoreSettings Tutorials Tutorials Overview General General FirmwareUpgrade CheckFirmwareVersion WhatiswebAdminPanel InternetConnection InternetConnection Repeater Setupasabridge Produceawiredconnection ConnecttoanexistingWi-Fi TurnoffWi-Fi HideSSID ConnecttoCaptivePortal ExtensibleAuthenticationProtocol SetupCaptivePortal IPv6 EasyTether VPN VPN OpenVPNClient OpenVPNServer OpenVPNBridge WireGuardClient WireGuardServer WireGuardServer Tableofcontents MakesureInternetServiceProviderassignsyouapublicIPaddress NetworkTopology InitializeWireGuardServer StarttheWireGuardServer Addanewclient Gettheconfigurationdetailsforyourclient TocheckifWireGuardServerisworkingproperly IfyourpublicIPaddressisdynamic WireGuardClientApp VisitClient’sLANSubnet InternetKillSwitch VPNPolicies TCPorUDP Privacy Privacy Cloudflare ProtectPrivacy NextDNS Tor 4G 4G SMS SMSForward CellsInfo Troubleshooting Troubleshooting Can'taccesswebAdminPanel RepairorReset DebrickviaUboot Others Others ChangeWANtoLAN LEDIndicators FileSharing MultimediaFileSharing DDNS Cloud Firewall SSHtotheRouter Modifyfilesontherouter CheckIPAddress InternetPriority MobileApp Findmodelnumber LuCI LEDCustomization Camera GL-AX1800newandoldversion SetupWireGaurdserverviaAstroRelay Troubleshooting Troubleshooting Overview RepeatFailure Can'tfindSSID OverrideDNSnottakeeffect GoodCloudissues ModemFAQ FAQs Development Development UARTSerial AdvancedUboot BLEMQTTBridge SetupWireGuardServeronGL.iNetrouter¶ WireGuard®isanextremelysimpleyetfastandmodernVPNthatutilizesstate-of-the-artcryptography.Itaimstobefaster,simpler,leaner,andmoreusefulthanIPSec,whileavoidingthemassiveheadache.ItintendstobeconsiderablymoreperformantthanOpenVPN. GL.iNetroutershavepre-installedWireGuardServerandClient. MakesureInternetServiceProviderassignsyouapublicIPaddress¶ PleasecheckifyouInternetServiceProviderassignsyouapublicIPaddresshere. Ifno,youcan'tconnecttotheWireGaurdServer. Analternativemethodistouseareverseproxysolution,wesuggestAstroRelay,checkthetutorialhere. NetworkTopology¶ IfGL.iNetrouteristhemainrouterinyournetwork,thisissimple,pleasemovetothenextstep. Ifyoualreadyhaveamainrouter,thentheGL.iNetrouterisunderthemainrouter,youmayneedtosetupaportforwardingonthemainrouter. Ifyoualreadyhaveamainrouter,theGL.iNetrouterisseverallevelsbelowitandyouneedtosetupportforwardoneachlevel. InitializeWireGuardServer¶ AccesstowebAdminPanel,ontheleftside->VPN->WireGuardServer.ClickInitializeWireGuardServer. StarttheWireGuardServer¶ YoucansimplyusethedefaultparametersofIPAddressandLocalPort,oryoucansetyourownvalue.ThenclickStarttostartyourownWireGuardserver. AllowAccessLocalNetwork:EnablethiswillalloweveryclientthatconnecttothisWireGuardServerbeabletoaccessyourLAN.Pleaseusewithcaution. Notethatyoucan'trunningVPNClientandServeratthesametime,andalsocan'trunningOpenVPNClientandWireGuardClientatthesametime. Addanewclient¶ YouhavetoaddanewuserandapplytheconfigurationswhenyouareconnectingtothisWireGuardServer. ClickManagementtabandthenAddaNewUser. SpecifytheNameofthenewclientandthenclickAdd. Gettheconfigurationdetailsforyourclient¶ Youcannowcheckthelistoftheclientsyouadded.YoucanDeleteanyunwantedclient.PleaseclickConfigurationstofindtheconfigurationdetailswhichyouneedtousewhenyouaresettingupWireGuardclient.WeprovideQRcodeandPlainText,youcanuseaTextEditorsoftwaretosavethePlainTextto.conffile. TocheckifWireGuardServerisworkingproperly¶ TocheckifWireGaurdServerisworkingproperly,wecanuseanotherdeviceconnectedtoanothernetworkandusetheWireGuardconfigurationweexportedearliertoconnectandseewhetheritconnectsproperlyandwhethertheIPaddressistheIPofWireGuardServer. ThesimpliestwayistouseacellphonewithWireGuardofficialclientappinstalled,turnoffitsWi-Ficonnection,andonlyconnecttoInternetvia3G/4G/5G.ThenopentheWireGaurdapp,importtheWireGaurdconfigurationfromQRcode.Enabletheconnection,checkifthephonehasInternetaccessandwhetheritsIPaddressistheIPofyourWireGuardServer. Thereareseveralcommonreasonscausefailed: TheInternetServiceProviderdoesn'tassignyouapublicIPaddress,pleasecheckhere. Youmayneedsetupportforwarding,pleasecheckhere. TheportyouareusingforWireGuardServerisblockedbytheInternetServiceProvider,changetoanotherport,orcontacttheInternetServiceProvider. Somecountries/regionsmayblocktheVPNconnection. IfyourpublicIPaddressisdynamic¶ SomeInternetServiceProvidersmaychangeyourIPaddresssometimes.Toovercomethis,enabletheDDNS,thenedittheconfigurationtoreplaceDDNSurlwithyourpublicIPaddress. Copythecontentoftheconfigurationtoatexteditor(e.g.Atom,Sublime). EdittheconfigurationtoreplaceDDNSurlwithyourpublicIPaddress. Afterreplaced. CopytherevisedcontenttogenerateaQRCode,orsaveitas.conffile. TheWireGuardconnectionmaydownawhilewhenthepublicIPaddresschanges,aftertheDDNSurlupdatetothenewpublicIPaddress,theconnecitonwillresume.TheDDNSisupdatedevery10minutes.Iftheconnectiondoesn'tresume,pleasemakesuretheDDNSurlispointtotnenewpublicIPaddress,thenturnofftheWireGaurdconnectionandturnonagain. WireGuardClientApp¶ WecanuseanotherGL.iNetrouterasWireGuardClient,orusetheirofficialapponotherdeviceswithvariousOS. PleaserefertoWireGuardOfficialWebsite:https://www.wireguard.com/install VisitClient’sLANSubnet¶ VisitClient’sLANSubnetfromWireGuardServerLANSubnet 1)ChangeWireGuardclientsLANIPtoavoidIPconflictionwithServer 2)ModifyWireguard_ServerConfiguration WinSCPorSSHintoyourtheWireGuardServer(router)findandmodifythefile /etc/config/wireguard_server Addalinetotheendoftheconfigfileofclientsyouwanttovisit. listsubnet'192.168.xxx.0/24' SaveandExit Backtotop