OpenWRT WireGuard Remote Access: Browser RDP and SSH to Your Whole LAN

OpenWRT runs on a huge slice of the routers MSPs actually manage in the field: repurposed consumer hardware, x86 firewalls, industrial gateways, and every GL.iNet, Teltonika, and Turris box under the hood. It ships WireGuard as a first-class protocol, which makes an OpenWRT router an ideal ProxyLink tunnel host. One outbound peer on the router covers every device on the LAN and every VLAN behind it, with nothing installed on the individual machines you need to reach.

The reason this matters: most branch and remote sites sit on consumer broadband or LTE with no static IP, frequently behind CGNAT. There is no port to forward and no inbound address to reach. Because a ProxyLink tunnel dials outbound and holds itself open with a keepalive, none of that is relevant. The site never accepts an inbound connection, so a scan of its ISP range finds nothing to connect to.

Installing WireGuard on OpenWRT

Recent OpenWRT releases include the WireGuard kernel module, but LuCI needs the protocol package to expose it in the web UI. SSH into the router and install it:

opkg update
opkg install luci-proto-wireguard wireguard-tools kmod-wireguard

Reload the LuCI page afterwards so the new protocol appears. On very small flash devices, check free space first with df -h; if the package will not fit, an x86 or higher-flash target is the better tunnel host for that site.

Getting the Config from ProxyLink

In ProxyLink, create a new tunnel for the site and set the LAN subnet to match the router. The OpenWRT default is 192.168.1.0/24. ProxyLink assigns the router a peer address in the 10.100.0.0/16 range and shows you the relay public key and endpoint. A downloaded config looks like this:

[Interface]
PrivateKey = <generated-private-key>
Address = 10.100.0.X/16

[Peer]
PublicKey = <proxylink-server-public-key>
Endpoint = 46.225.153.241:51820
AllowedIPs = 10.100.0.0/16
PersistentKeepalive = 25

AllowedIPs = 10.100.0.0/16 sends only ProxyLink tunnel traffic through the VPN, so the site's normal internet traffic still exits through the WAN. PersistentKeepalive = 25 is not optional: it keeps the NAT mapping alive and ensures the router re-initiates the handshake after a reboot or ISP reconnect.

Setting Up the Interface in LuCI

Go to Network → Interfaces → Add new interface. Name it proxylink and choose protocol WireGuard VPN:

1. On the General Settings tab, paste the Private Key from the config and set the IP Address to the assigned 10.100.0.X/16.
2. On the Peers tab, add a peer: paste the ProxyLink relay Public Key, set Endpoint Host to 46.225.153.241 and Endpoint Port to 51820, set Allowed IPs to 10.100.0.0/16, and set Persistent Keep Alive to 25.
3. Leave Route Allowed IPs enabled so OpenWRT installs the kernel route back to the relay.
4. Save & Apply.

Firewall: the Step People Miss

The tunnel will form, but traffic will not reach your devices until the firewall allows it. Under Network → Firewall, assign the proxylink interface to a zone and permit forwarding to your LAN zone. The simplest reliable setup is a dedicated zone with Input: accept and forwarding allowed to lan. If the site segments its network, add each VLAN's zone as an allowed forward destination too.

Multi-VLAN Sites

You do not need a second tunnel for a segmented network. Declare each extra subnet in ProxyLink under Additional Subnets, and every declared subnet becomes reachable through the same peer. A site with a main LAN on 192.168.1.0/24, a PBX VLAN on 192.168.10.0/24, and a camera VLAN on 192.168.20.0/24 uses one OpenWRT router and one ProxyLink tunnel. Keep the peer's Allowed IPs at the relay range only, and make sure the firewall forwards the tunnel zone to each VLAN zone.

What Engineers Access

Once the tunnel is up, create a proxy link for each device and service:

• Windows PCs and servers (port 3389), browser RDP, no mstsc.exe or VPN client on the engineer's laptop.
• Linux and the router itself (port 22), browser SSH terminal, with session recording on paid plans.
• NVRs and IP cameras (port 80 or 443), HTTP or HTTPS proxy link to the web UI, no port forwarding.
• PBX admin panels and managed switches, HTTP proxy to the web interface or SSH for CLI changes.

Every session is logged with engineer identity, target IP and port, start time, and duration. The site keeps zero open inbound ports, and access requires a ProxyLink login with two-factor authentication.

Verifying the Tunnel

SSH into the router and run wg show. A healthy tunnel shows a recent latest handshake and a non-zero received-bytes count. If the handshake never completes, confirm outbound UDP 51820 is not blocked upstream, check the relay public key was pasted exactly, and confirm the keepalive is set to 25.

Try ProxyLink free at app.proxylink.dev, no card required, free during early access. An OpenWRT site takes about 10 minutes to configure. Setup guides for MikroTik, pfSense, OPNsense, GL.iNet, and EdgeRouter are in the docs.