How to Set Up a VPN Server on OpenWrt from Scratch

OpenWrt is the closest thing to a superpower for home networking: free, open-source firmware that turns a compatible router into a fully capable VPN server with enterprise-grade firewalling. If you're comfortable with a little command line (or even just the web UI), here's how to setup VPN server OpenWrt with WireGuard, from packages to a tested tunnel.

> Quick answer: To set up a WireGuard VPN server on OpenWrt: install the WireGuard packages (via LuCI's software page or opkg), create a WireGuard interface with a private key and listen port, add peer configs for each travel device, put the interface in its own firewall zone with forwarding to WAN, forward UDP 51820 on your main router if OpenWrt isn't the edge device, set up DDNS, and test from an outside network before traveling.

Installing WireGuard Packages via LuCI or opkg

OpenWrt doesn't ship WireGuard by default on most builds, so step one is installing it.

Via LuCI (web UI):

1. Log into LuCI (usually 192.168.1.1), go to System > Software.
2. Click "Update lists," wait for it to finish.
3. Install: luci-proto-wireguard (adds WireGuard to the interface UI), wireguard-tools, and kmod-wireguard.
4. Reboot the router.

Via SSH (faster):

opkg update
opkg install luci-proto-wireguard wireguard-tools kmod-wireguard
reboot

Either way, confirm the install took: after reboot, Network > Interfaces > Add new interface should offer "WireGuard VPN" as a protocol. If it's missing, the luci-proto-wireguard package didn't install cleanly; check the software page for errors.

A note on storage: some small-flash routers (4MB/8MB) can't fit LuCI plus WireGuard. If you're on a tiny device, this is the universe telling you to upgrade the hardware. Most routers from the last several years have room.

Interface, Peers, and Firewall Zone Configuration

Create the WireGuard interface:

1. Network > Interfaces > Add new interface. Name it wg0, protocol "WireGuard VPN."
2. Generate a private key: click "Generate Key" (or run wg genkey over SSH and paste it). The public key derives automatically.
3. Set the listen port: 51820 (UDP). Note it; you'll forward this later.
4. Assign an address for the tunnel network, e.g., 10.14.0.1/24. This is a private subnet just for VPN clients, separate from your LAN.

Add peers (one per travel device):

1. In the interface's "Peers" tab, add a peer per device (laptop, phone, travel router).
2. For each peer: paste its public key (generate keypairs on the devices or centrally), set Allowed IPs to the client's tunnel address (e.g., 10.14.0.2/32 for the laptop), and check "Route Allowed IPs."
3. Generate the client config for each peer: OpenWrt won't hand you a QR code natively, so assemble the .conf manually or use a helper script. The client config needs the peer's private key, address (10.14.0.2/24), the server's public key, endpoint (your DDNS hostname:51820), AllowedIPs 0.0.0.0/0, and PersistentKeepalive = 25.

Key hygiene: generate each device's keypair on the device itself where possible, and transfer only public keys to the router. Private keys should never travel over email or chat.

Firewall zones (the step everyone gets wrong):

1. Network > Firewall > Zones. Create a new zone, call it vpn.
2. Cover the wg0 interface with it.
3. Set forwarding: allow forward from vpn to wan. This is what lets VPN clients reach the internet through your home connection.
4. Input/output on the zone itself: accept (so clients can reach the router's DNS, etc.).
5. Masquerading: enable on the WAN zone (usually already on). This NATs your VPN clients' traffic out your home IP correctly.

Without the forwarding rule, clients connect to the tunnel fine but can't reach anything beyond the router. "WireGuard connects but no internet" is this rule, nine times out of ten.

DNS for clients: in the peer/client config, set DNS to your router's tunnel address (10.14.0.1) or your preferred resolver. This keeps DNS inside the tunnel and avoids leaks.

Port Forwarding, DDNS, and Testing

If OpenWrt is your edge router (directly on the modem): add a traffic rule allowing UDP port 51820 inbound to the router itself (Network > Firewall > Traffic Rules: allow UDP, destination port 51820). That's it; no forwarding needed since the server lives on the edge.

If OpenWrt sits behind your ISP's gateway: forward UDP 51820 on the ISP gateway to the OpenWrt router's LAN IP. Give OpenWrt a static DHCP reservation so the forward doesn't rot. And if the ISP gateway is doing CGNAT (WAN IP in 100.64.0.0/10), port forwarding won't work; ask the ISP for a public IP, use IPv6, or fall back to Tailscale.

DDNS: OpenWrt has a ddns-scripts package with LuCI support (luci-app-ddns). Install it, configure your provider (or the free options), and verify the hostname updates. Your travel clients point at this hostname, so a stale DDNS entry is a dead tunnel.

Testing, in order:

1. Local test: connect a phone to mobile data (not your WiFi), activate the WireGuard tunnel, and confirm you can reach the internet and your visible IP is your home IP.
2. Leak test: run a DNS leak check from the tunneled phone. Only your chosen resolvers should appear.
3. Kill test: stop the WireGuard interface on the router mid-session and confirm the phone's traffic stops (if you've set up kill-switch-style firewall rules) rather than leaking.
4. Reboot test: reboot the OpenWrt router and confirm the WireGuard interface comes up on its own and clients can reconnect with no manual steps.
5. The real test: leave the house. A café down the street on their WiFi is the honest test. If it works there, it'll work from another continent.

Keep it updated. OpenWrt releases updates regularly; WireGuard is in the kernel and gets security fixes. A VPN server is internet-facing infrastructure, so treat updates as maintenance, not optional. The attendedsysupgrade path makes major upgrades relatively painless.

FAQ

Need help setting this up?

OpenWrt rewards the effort but punishes the learning curve. Our done-for-you setup gets your server built, secured, and tested: https://homeipvpn.com.