Skip to content

OpenWrt

TunGuard can connect to OpenWrt routers using WireGuard.

OpenWrt can run WireGuard directly or through AmneziaWG-compatible packages. When the configuration uses standard WireGuard parameters, it can connect to TunGuard without requiring any special TunGuard configuration.

Requirements⚓

  • OpenWrt router
  • WireGuard support installed on OpenWrt
  • A TunGuard server
  • Internet access from the router

Create a Peer⚓

Create a peer in the TunGuard dashboard.

For example:

Name: OpenWrt
Address: 10.100.0.2/32

Generate the peer configuration.

A typical configuration looks like:

[Interface]
PrivateKey = <client-private-key>
Address = 10.100.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = <server-public-key>
Endpoint = vpn.example.com:13231
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

Configure OpenWrt⚓

Install WireGuard support on OpenWrt if it is not already installed.

Then configure the WireGuard interface using the peer configuration generated by TunGuard.

The exact OpenWrt configuration method depends on your OpenWrt version and installed packages.

Verify the Connection⚓

On OpenWrt, check the WireGuard interface:

wg show

You should see the TunGuard server as a peer and a recent handshake when the connection is active.

You can also check the interface:

ip addr show

The WireGuard interface should have the VPN address assigned by TunGuard.

Routing Through TunGuard⚓

To route all traffic through TunGuard, the peer configuration can use:

AllowedIPs = 0.0.0.0/0, ::/0

For access only to the TunGuard network, use the VPN subnet instead:

AllowedIPs = 10.100.0.0/24

Choose the routing mode that matches how you want the OpenWrt router to use the tunnel.

OpenWrt as a Router⚓

OpenWrt can also use the TunGuard tunnel to provide access to devices behind the router.

For example:

                    TunGuard
                   10.100.0.1
                       |
                       |
                OpenWrt Router
                  10.100.0.2
                       |
              +--------+--------+
              |        |        |
            PC       Camera    Server

The OpenWrt router can route traffic between its local network and the TunGuard network according to its firewall and routing configuration.

AmneziaWG⚓

OpenWrt also has AmneziaWG-compatible packages available.

An AmneziaWG client can use standard WireGuard-compatible configuration when AmneziaWG-specific parameters are not enabled.

In that configuration, it can connect to TunGuard like a normal WireGuard peer:

OpenWrt
  |
  | WireGuard
  |
TunGuard

AmneziaWG-specific obfuscation parameters such as Jc, Jmin, Jmax, S1-S4, and H1-H4 require AmneziaWG protocol support on the server side.

TunGuard should therefore be configured with standard WireGuard parameters unless AmneziaWG support is explicitly available.

Troubleshooting⚓

No handshake⚓

Check the peer configuration:

wg show

Verify:

  • Server address
  • WireGuard port
  • Server public key
  • Client private key
  • Allowed IPs
  • Persistent keepalive

TunGuard's default WireGuard port is:

UDP 13231

Handshake works but traffic does not⚓

Check OpenWrt's firewall and routing configuration.

Verify the WireGuard interface has the expected address:

ip addr show

Check the routes:

ip route

Also make sure the OpenWrt firewall allows traffic between the WireGuard interface and the required networks.

OpenWrt is behind NAT⚓

Use:

PersistentKeepalive = 25

This keeps the connection active and helps maintain the NAT mapping.

Network Example⚓

A simple OpenWrt deployment can look like:

Internet
   |
   |
TunGuard Server
10.100.0.1
   |
   | WireGuard
   |
OpenWrt
10.100.0.2
   |
   +--- LAN: 192.168.1.0/24
          |
          +--- PC
          +--- Camera
          +--- Server

TunGuard provides the VPN connection. OpenWrt controls routing and firewall behavior for the local network.