WireGuard#

Protect → WireGuard manages the router's own in-kernel WireGuard: tunnels, which are interfaces with a key pair and a listen port, and the peers on each tunnel. Everything the page changes is a pending change like any other, applied from the bar at the foot of the page and rolled back the same way. Beside the configuration, the page shows what the router reports about each tunnel and peer, re-read every ten seconds.

Getting to the page#

The WireGuard entry carries the wireguard feature id in the navigation model, so it appears when the feature is switched on in Apps or when a WireGuard tunnel already exists in the configuration. A router that already runs WireGuard shows the page regardless of the switch.

What the page shows#

Four tiles: the number of Tunnels, the number of Peers, how many are Connected (a handshake in the last five minutes) and how many have Never connected.

The tunnel cards#

One card per tunnel, titled with its name and the state the router reports:

Badge	Means
Up	The router reports the interface up.
Off	The tunnel is turned off.
Down	The router reports it down — usually an interface that failed to come up.
Not reported	The router did not list it, which is not the same as down.

Each card lists the tunnel's Address, Listen port, MTU (Default when none is set), Description, its Peers with how many are connected, and its Public key — the one to give every peer. When the input firewall would drop the tunnel's listen port, the card says so. Add device, Add peer and Edit open the panels below.

The peer table#

Every peer on every tunnel, in one table.

Column	Shows
Peer	The peer's name.
Tunnel	The tunnel it is on.
Status	Connected (a handshake in the last five minutes), Idle (an older one), Never connected, or Not reported — the router did not list the peer, which is what a peer that is turned off looks like.
Last handshake	How long ago, counting on between reads.
Transfer	Received and sent, in the router's own wording ("6 KB"). The router prints no raw counters, so the column does not sort.
Endpoint	Where the peer is connecting from now, or Roaming when it has not connected.
Allowed IPs	The networks the kernel holds for the peer.

When the router did not report a peer, its endpoint and allowed IPs are the configured values, drawn faint, rather than a live value the router never gave.

Selecting a row opens the peer: its status with the last handshake, the amounts received and sent, the current endpoint and allowed IPs — and its settings.

Adding a tunnel#

Add tunnel opens a panel.

Field	What it is
Name	`wg` and a number. The lowest free one is filled in.
Addresses	The router's address in the tunnel, with the tunnel's prefix length — `10.10.0.1/24`. The prefix is the tunnel's network: devices added later are given addresses from it.
Listen port	The UDP port peers connect to. `51820`, or the next port no other tunnel uses.
MTU	Optional. Empty uses the router's default.
Description	Optional.
Key pair	Generate, or Use an existing key.
Allow the listen port through the firewall	On by default.

Generate has the agent make the key pair. The private key goes straight into the pending changes and is never sent to the browser, shown, or written to a log or the audit trail: the pending changes and the audit trail show [redacted] in its place for every role, administrators included. Once the change is applied, the tunnel card shows the public key. The private key is then part of the router's configuration: this page never shows it, and an administrator sees it only where the whole configuration is shown — the configuration tree in Advanced mode, or a backup.

Use an existing key takes a private key you paste — the way to move a tunnel from another router without every peer needing a new public key. A pasted key is a value you typed, and is handled like one.

Allow the listen port through the firewall adds an input firewall rule accepting UDP on the listen port, when the input firewall would drop it. The rule goes after the chain's existing accept rules and before the first rule that does anything else. When the port is already accepted, nothing is added.

Changing a tunnel#

Edit on a tunnel card opens its settings: the public key, Addresses, Listen port, MTU, Description, and Turned off, which keeps the tunnel configured and carries no traffic. When the input firewall drops the listen port, Allow UDP port 51820 adds the rule described above.

Delete tunnel asks again — Delete wg0 and its 2 peers? — and removes the tunnel with every peer on it.

Adding a peer#

Add peer on a tunnel card is for another router, or a device whose key you already have.

Field	What it is
Name	Letters, digits, dots, hyphens and underscores.
Public key	The peer's public key. Not the tunnel's own, and not one another peer on the tunnel has.
Allowed IPs	The networks this peer may send from, and the ones the tunnel hands to it. For a single device, its address as a `/32`.
Endpoint and Port	Where the router reaches the peer: an address or a host name, and a port. Leave both empty for a peer that connects from anywhere.
Keepalive	Seconds between keepalive packets. `25` keeps a NAT mapping open; empty is off.
Pre-shared key	Optional, and never shown: once set, the field says so and takes a new key to replace it. Remove the pre-shared key takes it off.
Description	Optional.
Turned off	On an existing peer: it stays configured and cannot connect.

Selecting a peer in the table opens the same fields, filled in. Delete peer asks again and removes it — which is how a device loses access.

Adding a device#

Add device on a tunnel card sets up a phone, a laptop or a tablet in one step: the agent generates the device's keys and its configuration, and the page shows it as a QR code.

Field	What it is
Device name	The peer's name on the router.
Address in the tunnel	Optional. Empty uses the next free address in each of the tunnel's networks.
Address devices connect to	The router's public address or a host name that points to it. It starts as the address this tunnel's last device was given, or else the router's WAN address, and is remembered for the next one.
Traffic through the tunnel	All traffic, or Local networks only, which lists the router's own networks for you to change.
DNS servers	The router's address in the tunnel, to start with.
Answer this device's DNS queries	When the DNS server is the router, adds what the router's DNS service needs to answer on the tunnel.
Keepalive	`25` seconds.
Pre-shared key	On by default: an extra key shared by this device and the router.

Add device adds the peer to the pending changes and shows the device's configuration: a QR code for the WireGuard app to scan, Download configuration for a <device name>.conf file, and the address it was given. Before the device connects lists anything that would stop it: an input firewall that drops the listen port, a DNS service that would not answer it, a forward firewall that drops traffic arriving on the tunnel.

The device can connect once the pending changes are applied.

What else a tunnel needs#

The forward firewall. Traffic arriving on the tunnel and going to the LAN or the internet passes the forward chain. Before the device connects says when it would be dropped; the rule is on the Firewall page.
Source NAT, for All traffic. A device sending everything through the tunnel reaches the internet only when the router translates the tunnel's addresses on the way out — a source NAT rule on the NAT page.
Routes, between sites. See the note under Adding a peer.

Advanced mode#

With Advanced mode on (Account → Preferences) the page adds a CLI view — the tunnels as configuration commands — and each panel previews the commands it will add. The CLI view shows every private and pre-shared key as [redacted], whoever is reading; a panel's preview shows a key only when you typed it into that panel.

What this page does not do#

Raw byte counters. Transfer is the router's own humanised wording; there is no number to graph.
Show a device's configuration again. See the warning above.