[egc]

WireGuard is an open-source VPN solution written in C by Jason Donenfeld and others, aiming to fix many of the problems that have plagued other modern server-to-server VPN offerings like IPSec/IKEv2, OpenVPN, or L2TP.

It can be seen as a replacement for OpenVPN although it does not have the versatility, possibilities and track record of OpenVPN yet.

However, it has two advantages over OpenVPN, it is much faster especially on lower-spec hardware such as Soho routers (my own R7800 goes from 85 Mb/s on OpenVPN to 270 Mb/s with WireGuard) and is easy to setup if you know how, the guides will help you with that.

To work with these guides DDWRT build 48214 or higher is mandatory.

See Changelog at the bottom of this page.

WireGuard is usually available on routers with 8 MB Flash RAM or more (there are a few exceptions) and using at least Kernel 3.10 (so not on K2.6 builds).


WireGuard client setup guide
Setup instructions to use your DDWRT router as WireGuard client.
For older builds, the second post contains a watchdog script to restart WireGuard or reboot the router when a connection is lost (usually WireGuard reconnects by itself), recent builds have this functionality built-in:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624

VPN and DNS guide
Advanced reading for DNS setup using VPN clients (WireGuard/OpenVPN) including DNS leaks, routing of DNS servers, adding extra DNS servers, Split DNS etc.:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=331017

WireGuard server setup guide
Setup your router as WireGuard server including instructions to setup clients like phone, windows PC and other DDWRT routers, this thread also contains scripts for earlier versions of WireGuard and a Troubleshooting section:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=322206

WireGuard Advanced setup
examples of advanced setup like using a WAP, multiple tunnels and Bridging solution:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787

VPN Troubleshooting guide with some tips for if you are really stuck, it is mainly for OpenVPN but also contains tips for WireGuard.

For questions or comments just open a thread in the Advanced Networking forum

Static routing
If the Built-in PBR possibilities are not sufficient you can use Static Routing See:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327810

Changelog
Build 47259
• Killswitch now works on a WAP. Because of the changing of the killswitch code it is recommended to check if your killswitch is still working, see page 11 of the WireGuard Client setup guide
• Status Window now adequately reflects the status of peers with the same key

Build 47284/47285
• Import Tunnel/Config added. This lets you import a config file from your provider or from your own server and adds a tunnel with it.
Not perfect yet, when deleting the tunnel make sure to disable all the tunnels first, Save and Apply. then delete the tunnel, Save/Apply and then Enable the tunnels again and Save/Apply.
Alternatively reboot the router after deleting a tunnel.
Problem can be in the DNS setting of the tunnel, DNS is not moved to the new tunnel number yet so reboot or restart DNSMasq. It is on the todo list.

Build 47602/47603/47604/47605/47612/47613/47615
(so after build 47608)
The DNS problem when a tunnel is deleted should be solved
Fail over/watchdog is added you can set one or more client tunnels in a fail over group if one is down the next will be started, if the last tunnel fails (so you can also set only one tunnel) WireGuard is resetted or the router is rebooted when nvram variable wg_onfail_reboot=1 is set.
Gui options to do this, also to start with random tunnel will be added later.
Important if you already have a client/or server running you need to click Save/Apply once on the tunnel page to start Wireguard after upgrading

Build 47692
Important if you upgrade from a build before 47692:
1. You can disable Query DNS in Strict Order on Services page. WireGuard no longer relies on strict-order to prevent a DNS leak and as there is a bug in strict-order you probably should disable it for DNS to work properly.
2. Entries in Policy Based Routing are not automatically converted, either put them in manually (if you want to retrieve the old values, from CLI telnet/Putty where X is the tunnel number: nvram get oetX_pbr
Or convert them with: