WireGuard VPN

WireGuard — is a free, open-source software application, virtual private network protocol (VPN) to transfer encrypted data and create secure point-to-point connections.

NOTE: Important! WireGuard VPN support is implemented for current generation Keenetic devices, starting from KeeneticOS version 3.3

The features and advantages of the WireGuard protocol are in the use of modern, highly specialized data processing algorithms. The codebase of the project is written from scratch and is characterized by its compact design.
WireGuard is part of the system kernel module. WireGuard connection is software accelerated and is multithreaded, i.e., it can work stably and use resources of one kernel.

Keenetic device can operate either as a VPN server or as a VPN client. The terms "client" and "server" are conditional due to the specifics of the protocol. But usually, the server is a device that waits for a connection, and the client is a device that initiates a connection.

When connecting to the WireGuard VPN server on Keenetic as a VPN client, you can use a computer (based on Windows, Linux, macOS), a mobile device (based on Android and iOS), or the Keenetic devices.

Using WireGuard VPN client on Keenetic, you can connect to a VPN provider that provides WireGuard VPN connection service or to other Keenetic that operates as a VPN server and get remote access to its local network.

NOTE: Important! If you plan to configure your Keenetic device as a VPN server, you should first check that it has a public IP address, and if you use the KeenDNS service, that it works in the direct access mode. If you do not comply with any of these conditions, you will not be able to connect to such a server from the Internet.

To set up protected tunnels via the WireGuard protocol in Keenetic routers, you need to install the 'WireGuard VPN' system component. You can do this in the web interface on the 'System settings' page in the 'Updates and component options' section by clicking on 'Component options.'


Then you will find the 'WireGuard' section on the 'Other connections' page.


To configure the WireGuard interface manually, click the 'Add Connection' button. We are not going to review the connection settings here, but you can find them in the detailed instruction:

You may also import WireGuard interface settings from a pre-created configuration file. Click the 'Download from file' button and then choose the path to the pre-configured file on your computer.

The main principles of WireGuard VPN operation:

1. Each WireGuard tunnel is a system interface operating at the third (network) layer of the OSI model. Traffic can be routed into it, and IP access policies can be configured (network screen).

The WireGuard interface has several main configuration parameters, which are: private and public key pair, address, listening port.

When creating the WireGuard interface, you will need to create a pair of encryption keys - Private and Public, as well as assign the internal IP address of the device in the VPN tunnel and determine the listening port number on the VPN server side.

Private and Public keys are used to secure the connection. These keys are used to authenticate the members. Public and private keys are a pair of keys that are created (generated) simultaneously. Cryptographic algorithms involve the joint use of such a key pair. Both keys must 'match' the encrypted part of the information. For example, if encryption is done with the private key, the decryption can be done only with the public key.
You need to generate encryption keys on both sides of the VPN tunnel. You will only need to exchange public keys on both sides of the VPN tunnel during the connection set up.

As for the internal address of the tunnel interface, it must be any suitable address from the private range, but it must not match the other subnets on the Keenetic router itself. This IP address is specified in the IP/bitmask format (e.g., Different addresses must be set on the VPN client and VPN server, but they should be from the same subnet. For example, on the server and on the client.

You will need to specify the listening port number on the VPN server side, and it will be used for incoming connections to the WireGuard interface. You can set the random port number (for example, 16632), the most important thing is that it should not be blocked by your ISP and should not match the already opened ports of other services on the router.

2. Then you need to add peer(s). A peer is a member or client of a specific connection. You can create multiple peers in one VPN connection, for example, to connect to a VPN server from various computers or mobile devices.

Each peer is uniquely characterized by the public key of the remote side. You will need to specify a public key to the device, the internal IP address of the tunnel, and the allowed subnets in the peer settings on the other side of the VPN tunnel.

List of allowed subnets (Allowed IPs) is a special parameter in the peer settings. These are address areas from which this peer can receive traffic (source IP addresses) and to which traffic can be sent (destination IP addresses). Technically, these addresses are used to encrypt and decrypt traffic. This technology is called Crypto Routing and is a fundamental feature of WireGuard. You must add a subnet to allow the transmission to any address.

It is essential to specify the public IP address or the domain name of the WireGuard VPN server on the VPN client side and specify the listening port which the VPN client will connect to (for example, myrouter01.keenetic.pro:16632). On VPN clients, this field is usually called Remote Endpoint.

It is also necessary to specify the interval of attempts to check the peer activity in its settings. It is an internal check of the accessibility of the remote side of the connection by sending keepalive packets in the tunnel. By default, the value of 'Persistent keepalive' in Keenetic peer settings is 30 seconds, but usually, 10 or 15 seconds between checks are enough.

3. WireGuard has an encryption key routing concept that uses private key bindings to each network interface. The VPN connection is initialized by sharing public keys and is similar to the SSH model.

The encryption keys are assigned to a list of VPN IP addresses allowed in the tunnel. Access to the list of IP addresses is allowed on the network interface. When the server accepts and decrypts an authenticated packet, its source field is checked. If it matches the one specified in the ''Allowed IPs' field of the authenticated peer, the WireGuard interface will accept the packet. When you send an outgoing packet, the destination IP address is checked to determine its legitimacy, and the appropriate peer is selected on its basis. Then the package is signed with its key, encrypted with the peer key, and sent to the public address and peer port (to Remote Endpoint). All IP packets received on the WireGuard interface are encapsulated in the UDP and are safely delivered to other peers.

WireGuard protects user data with advanced cryptography types: Curve25519 for key exchange, ChaCha20 for encryption, Poly1305 for data authentication, SipHash for hash keys, and BLAKE2 for hashing.
The Crypto Routing process allows you to provide a user with up to 100% trusted traffic and ensures high security and performance at the exit of the interface.

Examples of WireGuard connection settings

You can find detailed instructions on how to configure the Keenetic as a VPN server and VPN client to interconnect two local networks:

To set up a connection to VPN providers that can work with WireGuard, refer to the instructions:

You can use mobile devices based on Android and iOS to connect to the Keenetic router via WireGuard protocol:

Or you may use computers based on Windows, Linux, macOS:

Sometimes you want clients connected to the Keenetic router via WireGuard to access the Internet through this VPN tunnel. You will need to make additional configuration, please refer to the article:


Have more questions? Submit a request



Please sign in to leave a comment.