Using a Downloaded WireGuard Config File on OpenWrt (LuCI and CLI)
Step-by-step: turn a VPN provider's WireGuard .conf into a working OpenWrt interface, with firewall zone, kill switch and optional policy routing.
The short answer
- 1.Install the WireGuard LuCI package, create a WireGuard interface and paste the values from the provider's .conf.
- 2.Recent LuCI versions can load a .conf directly with the 'Load configuration' button on the interface page.
- 3.Put the interface in its own firewall zone with masquerading, and forward only LAN → VPN for a kill switch.
What's in the config file
A provider's file has two blocks: [Interface] for your side and [Peer] for the server. Each line maps to an OpenWrt field.
[Interface]
PrivateKey = <your-private-key>
Address = 10.64.0.2/32
DNS = 10.64.0.1
[Peer]
PublicKey = <server-public-key>
AllowedIPs = 0.0.0.0/0
Endpoint = 203.0.113.10:51820Setting it up in LuCI
- 01System → Software: update lists, install luci-proto-wireguard, then reboot.
- 02Network → Interfaces → Add new interface, name it wg0, protocol WireGuard VPN.
- 03Click Load configuration… and paste the .conf, or copy PrivateKey and Address by hand.
- 04On the Peers tab, tick 'Route Allowed IPs' so traffic actually goes into the tunnel.
- 05Firewall Settings tab: create zone 'vpn'. In Network → Firewall, enable masquerading on it and allow forwarding from lan to vpn.
The same thing from SSH
uci set network.wg0=interface
uci set network.wg0.proto='wireguard'
uci set network.wg0.private_key='<your-private-key>'
uci add_list network.wg0.addresses='10.64.0.2/32'
uci add network wireguard_wg0
uci set network.@wireguard_wg0[-1].public_key='<server-public-key>'
uci set network.@wireguard_wg0[-1].endpoint_host='203.0.113.10'
uci set network.@wireguard_wg0[-1].endpoint_port='51820'
uci set network.@wireguard_wg0[-1].route_allowed_ips='1'
uci add_list network.@wireguard_wg0[-1].allowed_ips='0.0.0.0/0'
uci commit network && /etc/init.d/network restartQuestions people also ask
+Handshake never completes — why?
Usually a wrong endpoint, an expired key on the provider's side, or the router's clock being wrong. Check Status → WireGuard for the last handshake time.
+DNS leaks?
Set the DNS from the .conf on the wg0 interface, and untick 'Use DNS servers advertised by peer' on wan.
Provider features, prices and streaming compatibility change often. We don't run lab benchmarks; confirm details on the provider's own site before buying. Read our responsible-use stance.
Keep reading
Best VPN for a GL.iNet Travel Router (WireGuard): What Actually Matters
How to choose a VPN for a GL.iNet travel router: WireGuard config export, server choice, key rotation and the features that matter more than brand.
Synology NAS: Run qBittorrent Behind a VPN Container (Gluetun + Container Manager)
A Container Manager project that routes only your torrent client through a VPN on Synology DSM 7.2+, with a built-in kill switch.