WireGuard Router Setup

Overview

This guide walks through configuring a WireGuard tunnel on a consumer router with a modern firmware stack (OpenWrt, pfSense, or a vendor provided WireGuard package). By the end you will have a validated client interface with a stable handshake, correct routing, and no DNS leaks.

Prerequisites

• Admin access to the router's web UI or SSH console.
• Firmware with a native WireGuard package (OpenWrt 21.02+, pfSense 2.6+, or vendor equivalent).
• A server side WireGuard endpoint with public key, endpoint host, and allowed subnet.
• One free UDP port for inbound handshake traffic (default 51820).

Step by step configuration

Generate the client key pair, create the tunnel interface, then attach a single peer with your provider's public key and endpoint.

1. 1

   Generate a key pair

   On the router shell, run wg genkey | tee privatekey | wg pubkey > publickey. Restrict the private key file to mode 600.

2. 2

   Create the WireGuard interface

   Assign a client IP inside the tunnel subnet (for example 10.0.0.2/32) and set DNS to the provider's resolver so lookups traverse the tunnel.

3. 3

   Attach the peer

   Enter the server public key, the endpoint host:port, allowed IPs (0.0.0.0/0 for a full tunnel), and a persistent keepalive of 25 seconds when the router sits behind NAT.

4. 4

   Open the firewall

   Allow outbound UDP to the endpoint port and permit forwarding between the WireGuard zone and your LAN. Add a masquerade rule on the WireGuard interface if the provider expects source NAT.

Validation

Bring the interface up and confirm the tunnel is doing what you expect before making it the default route for LAN clients.

Handshake and routing

Run wg show on the router. A recent 'latest handshake' timestamp and non zero transfer counters mean the tunnel is negotiated. Then verify the router's default route now traverses the tunnel with ip route get 1.1.1.1.