🔧

OpenWrt WireGuard Setup Guide

OpenWrt is open-source firmware that runs on hundreds of router models. It has full WireGuard support via packages. The setup uses firewall zones — OpenWrt does NOT use wg-quick, so PostUp/PostDown lines in your config file are ignored.

Install WireGuard packages

SSH into your router and run:

opkg update
opkg install wireguard-tools kmod-wireguard luci-app-wireguard

Reboot after installation.

Create a tunnel in ProxyLink

Go to Devices → + Add → Router / LAN site, select Home / LAN Router, enter your LAN subnet (e.g. 192.168.1.0/24), and complete setup to download your .conf file.

Add the WireGuard interface in LuCI

In LuCI go to Network → Interfaces → Add new interface.

Name: proxylink
Protocol: WireGuard VPN

Paste in your Private Key and set IP Address to your VPN IP with /24.

Add the server as a peer

Under the interface's Peers tab, add a peer:

Public Key: from your .conf file [Peer] section
Endpoint: from your .conf file
Allowed IPs: 10.100.0.0/16
Persistent keepalive: 25

Set up firewall zones

Go to Network → Firewall → Zones. Add a new zone:

Name: vpn
Input/Output/Forward: ACCEPT
Masquerading: checked
Covered networks: proxylink

Then add a Forward rule: from vpn to lan and from lan to vpn.

Save and bring up the interface

Click Save & Apply. The WireGuard tunnel will start automatically. Your router will connect to ProxyLink.

Good to know

PostUp/PostDown lines in the .conf file are silently ignored by OpenWrt. Use firewall zones (step 5) instead — this is the correct OpenWrt way to set up NAT.

LAN interface name on OpenWrt is br-lan. If you ever add manual iptables rules via SSH, use that name.

What you get once the tunnel is up

Browser RDP, VNC, and SSH — open a terminal or remote desktop to any device behind the tunnel straight from the ProxyLink dashboard. No client software, no open ports on your side.
Proxy links — share an HTTPS URL that forwards to any internal web interface (NAS, NVR cameras, PBX admin panels, router UIs) with ProxyLink login in front of it.
No public exposure — the device keeps zero open ports and needs no static IP. The tunnel is outbound-only WireGuard to EU-hosted infrastructure. Read more about agentless remote access and NIS2 compliance.

Ready to connect?

Create a free account and set up your first tunnel in minutes. Free during early access — no card required.

Start free → Other platforms

Setup guides for other platforms

🐧Linux Server 🪟Windows 🍎macOS 🤖Android 📱iPhone / iPad 🌐GL.iNet 🗄️Synology NAS 📡Asus Merlin ⚙️MikroTik RouterOS 7 📶TP-Link 🛡️OPNsense 🔒pfSense 🔵Ubiquiti UniFi Gateway 🔷Ubiquiti EdgeRouter 📻Netgear 🔌Zyxel