Gateway on an OpenWrt router

With the tunnel on the router, devices on your network leave from your Gateway and you can forward ports on it to any device behind the router. These steps use the command line over SSH. They are written for OpenWrt 23.05 and later.

1. Install WireGuard

opkg update
opkg install kmod-wireguard wireguard-tools luci-proto-wireguard

On releases that use apk instead of opkg, run apk update and apk add with the same package names. Reboot the router once the packages are in.

2. Get the config

On a computer, open your Gateway in the portal, choose A router, then OpenWrt, and continue to Add this connection to your router. Choose Download the config. It saves pb-gateway-linux.conf. The key is made in your browser and is never sent to us.

Open the file in a text editor. You need these values from it:

• Under [Interface]: PrivateKey, Address and MTU.
• Under [Peer]: PublicKey and Endpoint (the address and the port, split at the colon).

Ignore the Table and PostUp lines. They are for Linux servers. The file holds your private key, so keep it to this router and delete it when you are done.

3. Add the interface

Replace the values in angle brackets with the ones from the file:

uci set network.pbgw=interface
uci set network.pbgw.proto='wireguard'
uci set network.pbgw.private_key='<PrivateKey>'
uci add_list network.pbgw.addresses='<Address>'
uci set network.pbgw.mtu='<MTU>'

uci add network wireguard_pbgw
uci set network.@wireguard_pbgw[-1].public_key='<PublicKey>'
uci set network.@wireguard_pbgw[-1].endpoint_host='<Endpoint address>'
uci set network.@wireguard_pbgw[-1].endpoint_port='<Endpoint port>'
uci set network.@wireguard_pbgw[-1].persistent_keepalive='25'
uci add_list network.@wireguard_pbgw[-1].allowed_ips='0.0.0.0/1'
uci add_list network.@wireguard_pbgw[-1].allowed_ips='128.0.0.0/1'
uci set network.@wireguard_pbgw[-1].route_allowed_ips='1'
uci commit network

The two /1 ranges cover every IPv4 address. The file lists 0.0.0.0/0. The two halves are used instead so the tunnel wins over your existing default route without changing it. OpenWrt keeps a separate route to the endpoint, so the tunnel itself still uses your normal connection.

4. Put it in the WAN firewall zone

ZONE=$(uci show firewall | sed -n "s/^\(firewall\.@zone\[[0-9]*\]\)\.name='wan'$/\1/p")
uci add_list "$ZONE.network=pbgw"
uci commit firewall
/etc/init.d/network restart
/etc/init.d/firewall restart

The WAN zone translates your devices' private addresses to the Gateway and blocks unsolicited inbound traffic, the same as it does on your normal connection.

5. Check it worked

• wg show pbgw latest-handshakes on the router prints a recent timestamp, not 0.
• On a device behind the router, ifconfig.me shows your Gateway.
• The Gateway page, on I have loaded the config, shows Connected.

Forward a port on the Gateway

To send connections on the Gateway's port 443 to a device at 192.168.1.20:

uci add firewall redirect
uci set firewall.@redirect[-1].name='gateway-443'
uci set firewall.@redirect[-1].src='wan'
uci set firewall.@redirect[-1].src_dip='203.0.113.25'
uci set firewall.@redirect[-1].src_dport='443'
uci set firewall.@redirect[-1].dest='lan'
uci set firewall.@redirect[-1].dest_ip='192.168.1.20'
uci set firewall.@redirect[-1].dest_port='443'
uci set firewall.@redirect[-1].proto='tcp'
uci commit firewall
/etc/init.d/firewall restart

src_dip limits the forward to the Gateway, so your normal address is not opened as well.

Using LuCI instead

The same settings are in the web interface. Under Network → Interfaces, choose Add new interface and protocol WireGuard VPN. Enter the PrivateKey, Address and MTU from the file. On the Peers tab, add a peer with the PublicKey and Endpoint, set Allowed IPs to 0.0.0.0/1 and 128.0.0.0/1, set Persistent Keepalive to 25, and tick Route Allowed IPs. On Firewall Settings, assign the interface to the wan zone.

Things to know

• Lost the file? The private key is shown once. Make a new key on the Gateway page and load the new values. It replaces the old key and disconnects the router.
• IPv6 is not carried yet. Devices with IPv6 still use your normal connection for IPv6 sites.
• Mail ports 25, 465 and 587 are closed outbound on the Gateway.
• To stop using the tunnel, run ifdown pbgw. To remove it, delete the pbgw interface and its peer, and remove pbgw from the WAN zone.