A WireGuard tunnel for a laptop#

You will end up with a WireGuard tunnel on the router, one peer per device, and a laptop or phone that can reach the LAN from anywhere. This is the answer to "I want to reach my network from outside" that does not involve publishing a service to the internet.

Before you start#

• The operator role and a licence.
• The WireGuard page. It appears under Protect once the WireGuard module is switched on in Services → Apps, or once a tunnel exists.
• The WireGuard app on the device — the official one on a phone, or the desktop client.
• An address the device can reach the router at from outside: the router's public address, or a host name that follows it — see dynamic DNS if the address changes.

Step 1 — Add the tunnel#

Protect → WireGuard → Add tunnel.

• Name: wg0 is filled in.
• Addresses: the router's address in the tunnel, with the tunnel's prefix — 10.10.0.1/24. Pick a network used nowhere else on yours: devices get their addresses from it.
• Listen port: 51820 is filled in.
• Key pair: leave it on Generate. The router keeps the private key; nobody, including you, ever sees it.
• Allow the listen port through the firewall: leave it on, so the router's input firewall accepts the tunnel's packets.

Add tunnel, then Apply changes in the bar at the foot of the page. The tunnel card shows the tunnel Up, with its public key.

Step 2 — Add the laptop#

Add device on the tunnel card.

• Device name: laptop.
• Address in the tunnel: leave it empty for the next free address.
• Address devices connect to: the router's public address or host name. The WAN address is filled in when the router has one; a host name is better if it changes.
• Traffic through the tunnel: All traffic sends everything through the router, which is what you want on café Wi-Fi. Local networks only sends just your networks through it, and the rest of the device's traffic goes its usual way.
• DNS servers: the router's address in the tunnel, so names on your network resolve. Answer this device's DNS queries adds what the router's DNS service needs to answer on the tunnel.
• Keepalive 25 and Pre-shared key on are right for a device that roams.

Add device shows the device's configuration: a QR code, and Download configuration for a laptop.conf file. Scan the code with the phone's WireGuard app, or import the file on the laptop. Before the device connects lists anything on the router that would stop it — the forward firewall, the DNS service.

Apply changes, then connect from the device.

Step 3 — Let the tunnel reach the LAN#

Traffic arriving on wg0 and going anywhere else passes the forward firewall, which on a default-drop ruleset drops it. On the Firewall page, add a forward rule accepting traffic arriving on wg0 — narrowed to the hosts or networks the tunnel should reach, if not everything. Before the device connects says when this rule is missing.

For All traffic, the device reaches the internet through the router only when its tunnel address is translated on the way out: a source NAT rule on the NAT page that masquerades 10.10.0.0/24 behind the uplink. A masquerade rule for the whole LAN does not cover the tunnel's network unless it matches it.

Check it worked#

On the WireGuard page, the laptop's row turns Connected, with its last handshake a few seconds ago, the address it connected from, and its traffic. Then, from the laptop:

ping -c 3 10.10.0.1        # the router's address in the tunnel
ping -c 3 192.0.2.1        # the router's LAN address

Removing a device#

Select the device in the peer table, Delete peer, and apply. A peer that is not in the configuration cannot connect, which is how a lost phone loses access. Its keys existed only in its configuration, so there is nothing else to revoke.

Edit on the tunnel card has Delete tunnel, which removes the tunnel and every peer on it.

See also#

• WireGuard between two sites
• Join a tailnet from the router — the same job with somebody else's coordination server
• Keep a name pointed at a changing address
• WireGuard — every field on the page