OpenWrt + WireGuard: the complete 2026 setup + multi-site guide

Does OpenWrt support WireGuard?

Yes — OpenWrt has shipped WireGuard support natively since OpenWrt 19.07, released in January 2020. On modern OpenWrt builds (22.03, 23.05, and 24.10) WireGuard is in the default LuCI web interface. On older firmware you install the wireguard-tools and luci-app-wireguard packages from opkg.

The kernel module ships in the standard OpenWrt build for almost every supported architecture — ath79, ramips, ipq40xx, ipq807x, mvebu, x86_64 — which covers the chipsets in nearly every TP-Link, GL.iNet, Linksys, Asus, and NETGEAR router that runs OpenWrt. If your router is on the official supported devices list, you almost certainly have WireGuard available.

There is one exception worth knowing about: very low-RAM devices (16 MB or less) sometimes drop the WireGuard kernel module from the build to save space. If opkg install kmod-wireguard says "package not found," that's the likely cause.

How OpenWrt's WireGuard actually works

WireGuard on OpenWrt is configured the same way every other network interface is — through /etc/config/network, edited either by hand or via LuCI's web UI. There is no separate WireGuard service, no daemon to start, and no userspace tunnel process. The kernel module handles encryption directly; OpenWrt's normal routing table and firewall rules apply to the resulting wg0 interface like they would to any other.

That single design choice — WireGuard as a first-class kernel interface — is why it integrates so cleanly with OpenWrt and why the configuration is so much shorter than the equivalent OpenVPN setup. There is no certificate management, no TLS handshake to debug, no CA to rotate. Every peer has a fixed public key, and a configuration file lists every peer the local node is allowed to talk to.

The result on a working tunnel is summarized by one command: wg show wg0. It prints the local public key, the listen-port, every peer's public key, the last handshake time, and the bytes transferred. If a peer isn't listed in wg show, the kernel has never accepted a packet from it.

Setup with LuCI (recommended for most)

The LuCI flow is the right path for a one-router single-site setup. For multi-router or many-peer setups, the CLI path described next is faster.

1. SSH to the router. Connect to your OpenWrt router's LAN address — by default ssh root@192.168.1.1.
2. Install the packages. Run opkg update && opkg install wireguard-tools luci-app-wireguard kmod-wireguard. On modern OpenWrt builds the kernel module is usually already present; opkg will skip what's installed.
3. Generate the keypair. Either run wg genkey | tee privatekey | wg pubkey > publickey on the router itself, or generate the keys on your laptop and paste them in.
4. Open LuCI in a browser. Navigate to Network → Interfaces → Add new interface. Name it wg0 (or whatever you prefer; the name is local), and select WireGuard VPN as the protocol.
5. Configure the interface. Paste your private key. Set a listen-port (51820 is the convention but anything works). Set an IPv4 address that won't collide with anything else on the mesh — 10.100.0.2/16 is a common choice. Save.
6. Add a peer. Open the new interface, switch to the Peers tab, and click Add Peer. Paste the remote public key, set Allowed IPs (typically the remote overlay /32 plus any LAN subnet you want to reach behind that peer), set Endpoint Host and Endpoint Port if the remote has a stable public address, and set Persistent Keepalive to 21 seconds if the local router is behind NAT.
7. Attach to a firewall zone. Under Network → Firewall → Zones, attach wg0 to the lan zone, or create a dedicated vpn zone with input/forward rules that match your security posture.
8. Restart networking. Run /etc/init.d/network restart on the router and confirm with wg show that a handshake has completed within a few seconds of the peer also being configured.

Setup with the CLI (for headless or automation)

If you're configuring more than two routers, the LuCI flow becomes tedious. The same configuration can be set via UCI commands directly:

uci set network.wg0='interface'
uci set network.wg0.proto='wireguard'
uci set network.wg0.private_key='YOUR_PRIVATE_KEY'
uci add_list network.wg0.addresses='10.100.0.2/16'
uci set network.wg0.listen_port='51820'

uci add network wireguard_wg0
uci rename network.@wireguard_wg0[-1]='wg0_hub'
uci set network.wg0_hub.public_key='REMOTE_PUBLIC_KEY'
uci set network.wg0_hub.endpoint_host='hub.example.com'
uci set network.wg0_hub.endpoint_port='51820'
uci set network.wg0_hub.persistent_keepalive='21'
uci add_list network.wg0_hub.allowed_ips='10.100.0.0/16'

uci commit network
/etc/init.d/network restart

This is the format MeshWG generates if you pick the OpenWrt option in our vendor config picker — paste-ready, no values to edit. For OpenWrt automation, the CLI form is also the format Ansible's community.general.uci_set module expects.

Performance on common chipsets

WireGuard's throughput on OpenWrt is almost entirely CPU-bound: there is no hardware encryption offload on consumer routers, so the symmetric-crypto performance of the SoC sets the ceiling. The realistic numbers across the OpenWrt-supported chipset families:

WireGuard is consistently 3–5× faster than OpenVPN on the same hardware, and 2–3× faster than IPsec in pure-software mode. For most Indian SMB branch deployments the local internet uplink (50–200 Mbps) is the binding constraint, not the router's WireGuard performance, on anything mt7621 or newer.

When one router becomes ten branches

OpenWrt's WireGuard implementation is excellent at one thing: a single tunnel between two specific endpoints. It becomes painful when the operator wants any of the following:

• Three or more sites, fully meshed. Three sites require three peer-pair configurations across six router config files. Ten sites require forty-five. Hand-maintaining this works for a single technical operator; it does not work for a multi-branch business where each branch is configured by a local IT contractor.
• One router goes down and a new key has to be distributed. Every other router in the mesh needs its peer list updated. Without a central place that holds the canonical peer list, half the sites will end up out of sync within a quarter.
• Per-peer access policy. WireGuard's AllowedIPs is route-and-encryption combined; you cannot say "allow this peer to reach that LAN but not the other LAN" without a firewall rule on top, applied at the destination. For multi-branch, that means firewall rules in every router, with no central place to audit them.
• NAT traversal across CGNAT or double-NAT. WireGuard handshakes initiate outbound, so a peer behind CGNAT can reach a peer with a public endpoint. But two peers both behind CGNAT cannot directly reach each other — they need a relay. OpenWrt does not include a relay layer; that's where a managed service that runs the relay (and rotates it across regions for latency) earns its keep.
• Visibility. wg show is the only diagnostic. Across 10 routers that's 10 SSH sessions to read 10 outputs to answer "is everything working?"

How MeshWG fits with OpenWrt

MeshWG is a hosted mesh layer that runs above OpenWrt's native WireGuard. Your router continues to use exactly the same kernel module and the same /etc/config/network file; MeshWG provides:

• Generated configuration. For each OpenWrt router you add, MeshWG produces a paste-ready UCI command block (the format shown in Setup with the CLI above) with every peer pre-populated. New site joins the mesh, MeshWG regenerates everyone's AllowedIPs so you don't.
• Central policy. Allow / deny rules between any two devices are configured once in the dashboard. The rules are pushed to the controlling layer; the routers don't need per-site firewall changes to enforce them.
• NAT traversal. The relay layer handles the double-CGNAT case automatically; your routers don't change their configuration.
• Visibility. A single dashboard view of every peer's last handshake, transferred bytes, and connection state — no SSH-ing into ten routers to read ten wg show outputs.
• Honest billing. First two routers are free forever. After that, ₹349/router/month billed annually (or ₹499/router/month month-to-month), in INR via Razorpay. No per-tunnel charges, no enterprise paywall.

The OpenWrt + MeshWG combination is what most multi-branch buyers actually want: keep your existing OpenWrt firmware, your existing routers, your existing firewall rules — add a mesh layer on top that handles the parts that don't scale.

Frequently asked questions