WireGuard 1-Click Peer Generator for OpenWrt

I use WireGuard on OpenWrt, but I create new peers so infrequently that every time I need to add one, I have to look back through my existing peer settings to remember exactly what to enter.

Yes, OpenWrt can generate a new key pair and generate a configuration, but I still found myself having to figure out things like:

• Which WireGuard IP should I use next?
• What should I put in Allowed IPs?
• What settings did I use on the last peer?

So, I decided to make the process easier.

I went over to ChatGPT and worked through creating a script that adds a new option under "Network" called:

WireGuard Peer Generator

During the install of the script it will ask you if you want to access your lan with the vpn and will add the correct ip settings based on your network.

The script will automatically look at your current WireGuard setup and fill in the important settings for you, including the server public key, your WAN/public IP for the Endpoint Host/IP, and your current WireGuard IP range.

Creating a new peer is simple. Open Network → WireGuard Peer Generator, enter a name for the new peer, and click Generate Peer.

For example, if the last peer used:

10.200.0.53/32

the next peer will automatically use:

10.200.0.54/32

Once the peer is generated, you can scan the QR code with the WireGuard app or save the generated client config file.

When you are ready, click Save & Apply.

That adds the peer to the WireGuard peer list, commits the network configuration, and restarts the WireGuard interface so the new peer takes effect.

So after the initial setup, creating a new WireGuard peer basically comes down to entering a name and clicking generate.

I’ve included the script for anyone who wants to look it over, improve it, or use it as a starting point for their own OpenWrt setup.

Last week I was at my parents’ house realized they a Wireguard config file on their TV to access my plex server.

So I connected to m VPN, opened up Openwrt, clicked on network / Wireguard Peer Generator, went straight to the name and typed in “Parents Chromecast” and clicked generate, downloaded the configuration file and clicked save and apply.

Then I added it to their Wireguard on their google Chromecast, and it connected first try!

So literally all that is required to create a working Wireguard peer is a name.

I’ve included the script for everyone to look over.

Download / look at Script

https://gist.github.com/warwagon1979/6025ff453c47150dcf314e63261e7bbe

You can save it out as a .sh file of your choice

Installation

I made this for myself so use at your own risk.

Sending it to openwrt

Replace filename.sh with the name of your file

From CMD

"C:\Program Files\PuTTY\pscp.exe" -scp "C:\Users\\(username)\Downloads\filename.sh" [email protected]:/tmp/filename.sh"

In Putty

sed -i 's/\\r$//' /tmp/filename.sh.sh

chmod +x /tmp/filename.sh

sh /tmp/filename.sh

To uninstall it

rm -f /usr/share/luci/menu.d/luci-app-wg-peer-gen.json

rm -f /usr/share/rpcd/acl.d/luci-app-wg-peer-gen.json

rm -f /www/luci-static/resources/view/network/wg_peer_gen.js

/etc/init.d/rpcd restart

/etc/init.d/uhttpd restart

V1.2.2

Fixed: The installer was stopping after the LAN access prompt, which prevented the LuCI files from being created. Because of that, the WireGuard Peer Generator was not being added under the Network menu. This update fixes the install process so it continues properly and installs the menu entry, ACL file, JavaScript page, and default configuration.

A Docker Compose stack where Firefox shares Gluetun's network namespace (`network_mode: service:gluetun`) instead of connecting through a proxy or a routing rule. It fails closed by construction, through two separate mechanisms: if the WireGuard tunnel drops while Gluetun runs, Gluetun's firewall drops all non-tunnel traffic (including LAN); if the Gluetun container itself dies, the shared namespace dies with it and the browser has no interfaces at all.

Ports publish only on the Gluetun service, bound to 127.0.0.1, so nothing reaches the LAN even when the tunnel is up.

Both failure modes are testable: `verify.sh` in the repo runs a two-sided kill-switch check (probe succeeds with the tunnel up, must fail with it stopped) plus exit-IP and DNS-resolver checks.

CI (ShellCheck, Hadolint, Checkov, KICS, Trivy) runs on every push and weekly.

Works with any Gluetun-supported WireGuard provider.

MIT licensed; no application code — a compose file, a short Dockerfile, and three shell scripts. Config and docs were AI-assisted (Claude Code, disclosed in the README), which is exactly why the automated checks exist: verify, don't trust.

GitHub: github.com/silverfox-2096/private-browser

Interested in feedback on the namespace-sharing approach versus more common proxy-based kill switches.

Hey guys, hoping someone with BGP or ISP routing experience can point me in the right direction.

Up until a few weeks ago, I was getting a perfect 17–19ms ping. The routing was going directly across the Strait of Gibraltar to Madrid. But out of nowhere, my ISP messed with their BGP tables and my latency permanently jumped to 29ms.

I ran tracertand PingPlotter, and it turns out my ISP is now dumping all traffic bound into Marseille, France, before routing it back down to Spain. This is happening 24/7, so it's a permanent route change on their end, not just peak-hour congestion.

What I've tried so far:

VPS using AWS & Azure
Cloudflare WARP enpoints
using ipv6

but still no luck all of them travel till Marseille France, then come back to Madrid where the game server is then come to me.

any method actually be able to bypass , i"m leaving switching ISP to last resort cue its a bit complicated.

ping test before isp messed routing
ping after isp messed routing

I need to set up wireguard to route VPN to my house computer while I’m traveling- when I configured the wireguard I lost Internet connection so something keeps messing up. I also got nordVPN but that’s not what I need. I need my GL-iNet Opal travel router to route everything through my ASUS home router. Any tutorials would be so helpful, I been trying to do it with ChatGPT but it’s not working.

I used to be able to turn on "on demand" and/or "always on" but they are missing from settings. It no longer auto connects to my VPN when on cellular or a different network. It makes me manually hit the button in the app. What do I do to get it to auto connect again?

Hi, pals

For my business, I need to set up a local IP address in the U.S. from certain states, and I was about to look for some VPS options, but I only know about Linode, Akamai, DigitalOcean, etc.—the most popular ones, and maybe also the most expensive ones...

That’s why I’m asking—just in case anyone knows of some good, reliable, and affordable VPS options located in places like Delaware, Texas, New Hampshire, Oregon, etc., so I can take a look and choose...

Basically, I'm going to be traveling and my work would greatly benefit from having access to my home network. I have an IT/help desk background with some basic networking knowledge.

My main dilemma is that I am unable to put the ISP router into bridge mode because at the moment setting up an entire new firewall and wireless setup would be a nightmare. Additionally, my parents are less than enthusiastic when I work on the home network, specifically my dad as he works from home and doesn't keep regular hours. I've also been told by some Verizon technicians that it could mess up the set top boxes which operate via MoCA from the router itself.

So is there any way to setup a site to site with my own router without having downtime on the main network. I have access to the admin panel on the ISP router, so that is not an issue.

For my setup: I will be most likely purchasing the Beryl 7 or AX from Gl.iNet as my travel router, and pairing with any budget friendly router that supports WireGuard. Any recommendations are appreciated! :)

Thanks all for your time and help!

My ISP router model: Verizon FiOS G3100

I've set up a wireguard network for my friends and I, where we all connect to wireguad on my VPS with a static IP, so that we can play a game which require open ports and has no auth. For some reason the wireguard client on my PC (windows 10) loses connection after random periods of time and will not reconnect (handshake for peer 1 did not complete after 5 seconds). Turning the wireguard tunnel off & on again does not fix the issue, however killing all wireguard processes with task manager and re-starting them does fix the issue. My 3 other friends, which all use windows 10 or 11 as well, haven't had that issue yet.

Here's my wireguard config, I hope y'all got any ideas what my issue might be, thanks in advance.

[Interface]
PrivateKey = xxxxxxxx
ListenPort = 51821
Address = 10.10.11.2/24
MTU = 1200

[Peer]
PublicKey = xxxxxxxx
AllowedIPs = 10.10.11.0/24
Endpoint = xxx.xxx.xxx.xxx:51821
PersistentKeepalive = 3

My current set up for a device in my organisation is for on demand cellular and wifi except for a specific SSID.

When the VPN server is down, the device is not able to access the internet.

Is there a workaround that I can use to allow the VPN to be bypassed, when the VPN server is down?

If not, if I disable cellular on demand will a user be able to hotspot from their phone or does WireGuard consider that a WiFi connection given it’s not direct cellular?

Hey zusammen,

Bin absoluter Neuling und würde gerne kurz und einfach wissen, warum Wireguard trotz offenen Port sicher ist?

Viele User richten es bei ihrem Heimrouter ein, um jederzeit sich mit dem Heimnetz verbinden zu können.

• Ist es so, weil jede Anfrage ohne Schlüssel sofort blockiert wird?
• Besteht dennoch ein Risiko dass jemand auf meinen offenen Port kommt? Ausnahme: ich verliere mein Endgerät mit dem Schlüssel

Bitte kurz und einfach Antworten, danke :)

Before I spend the time migrating everything, I wanted to ask people who have been running plain WireGuard for a while.

I've been using Tailscale for several years and have also spent some time with NetBird. Both are great pieces of software, but they each have their own tradeoffs.

Tailscale has been incredibly reliable and just works. My biggest hesitation has always been the trust factor. As someone who values open source software and privacy, relying on a company for the coordination layer has never sat completely right with me. I'm honestly surprised I've stuck with it for as long as I have.

NetBird's fully open source server side story was very appealing, but in my experience it still feels unfinished. I ran into enough client side issues, especially on Android, that I eventually lost confidence in it. At this point I would have expected a more stable experience.

That brings me to plain WireGuard. I know it's a much more manual approach, but I'm willing to put in the work if it means having a simpler, fully self-managed setup.

For those of you who have been using WireGuard for a long time, what should I know before making the switch? What are the biggest downsides that someone coming from Tailscale might not think about until after migrating?

For context, I currently run Tailscale on as many devices as possible, including my Android phone and Linux laptop for remote access. I self-host quite a bit on a couple of Proxmox nodes at home and primarily use Tailscale to access those services when I'm away.

I also use one of my Proxmox nodes as a subnet router and exit node. Through the Tailscale admin console, I configure my two AdGuard Home instances as my primary and secondary DNS servers so my phone and laptop continue to benefit from ad blocking and recursive DNS while away from home.

I know I can replicate most of this with WireGuard, but I'm more interested in the things you only discover after living with it for a while.

What do you wish someone had told you before you switched to plain WireGuard?

Thanks!

I just switched to e/os in an effort to degoogle, but suddenly i cant access my home subnet, with the same config file as before.

I cant for the life of me figure out how it gives me 2 separate ip addresses with one tunnel, and why one of them has to be the gateway, which is almost certainly why it doesnt work.

Also, when connected to a commercial VPN, it functions normally.

Any and all help would be greatly appreciated!!

Edit: through testing, i dont think the 2 ip addresses are the problem, but i still cant access my server from my phone. so the question stands:)

These are my config files:

Server

``` [Interface] Address = 10.100.0.1/24, fd08:4711::1/64 ListenPort = 47111 PrivateKey = {key} PostUp = nft add table ip wireguard; nft add chain ip wireguard wireguard_chain {type nat hook postrouting priority srcnat\; policy accept\;}; nft add rule> PostDown = nft delete table ip wireguard; nft delete table ip6 wireguard

laptop

[Peer] PublicKey = {key} PresharedKey = {key} AllowedIPs = 10.100.0.3/32, fd08:4711::3/128

phone

[Peer] PublicKey = {key} PresharedKey = {key} AllowedIPs = 10.100.0.2/32, fd08:4711::2/128 ```

Phone

``` [Interface] Address = 10.100.0.2/32, fd08:4711::2/128 DNS = 10.100.0.1 PrivateKey = {key}

[Peer] AllowedIPs = 10.100.0.1/32, fd08:4711::1/128, 192.168.0.1/24 Endpoint = {ip}:47111 PersistentKeepalive = 25 PublicKey = {key} PresharedKey = {key} ```

Laptop

``` [Interface] Address = 10.100.0.3/32, fd08:4711::3/128 DNS = 10.100.0.1, fd08:4711::1 PrivateKey = {key}

[Peer] PublicKey = {key} PresharedKey = {key} Endpoint = {ip}:47111 AllowedIPs = 10.100.0.1/32, fd08:4711::1/128, 192.168.0.1/24 PersistentKeepalive = 25

```

Hello Guys,

what i want to do is to have home IP from away connection done using my vps. SO client should connect from the internet to VPS (and this is OK), and i want to connect from Synology NAS to this VPS without opening ports.
Therefor i want this Client to have my home IP (it can or can not access local devices?, better not).
Is it possible to have connection created from Synology (192.168.1.x) to VPS, and connect there also client from outside, and somehow allow this Client to be visible as it is on my home?
Funbox 7 i think does not allow VLANS to separate this Client from the network?
How would You do this?
i do not need any gui configuration, but on Syno i use docker for wg, and on VPS there is podman. I think the main problem is to controll routing for all interfaces and use iptables? to create properly the communication schema.
Can You gimme a tips, what should be the routing rules? Or better a documentation what to read.
Also do i need somehow to configure anything on funbox to achieve this?
For now i could get connection from CLient to VPS having VPS IP, trying to do what i want stoped my traffic on client, and i do not know where there is a problem.

Hi everyone,

I am attempting to run WireGuard (using the wg-easy image) via Docker on my Synology DS218+ (DSM 7.x). The container starts correctly, but fails to initialize the network interface, preventing the VPN tunnel from coming up.

Technical details:

• NAS Model: DS218+ (Intel Apollo Lake architecture) with with the latest DSM 7 version.
• Environment: Synology Container Manager
• Issue: The container log explicitly states that the host kernel does not support WireGuard and fails to create the wg0 device.

Relevant logs: at async WireGuard.getConfig (/app/lib/WireGuard.js:72:7) This usually means that your host's kernel does not support WireGuard! Error: WireGuard exited with the error: Cannot find device "wg0" $ wg-quick up wg0 $ wg-quick down wg0

The permissions for the WireGuard directory are correct, and the "wg0" file is located there.

Does anyone know if it is possible to manually inject the WireGuard kernel module on a DS218+ (DSM 7.x), or if there is a specific configuration in Docker/Container Manager to resolve the "Cannot find device" error? Any pointers toward a solution for this specific hardware would be greatly appreciated.

Edit: I decided not to install WireGuard as a Docker container on my Synology NAS, but rather on my Raspberry Pi, which is already running Pi-hole. The installation was successful, and the two are running side-by-side without any issues. The VPN connection is also working perfectly.

Thanks you all for your help.

Every time I start up a VPN connection via Surfshark app in Manjaro, it disconnects Wireguard and instead uses OpenVPN protocol. I have Wireguard tools installed, so don't ask me that question. Is there an issue with the app or the operating system?

wg-doctor v0.2.0 is out: a small, read-only diagnostic helper for WireGuard setups.

This release focuses on shareable diagnostics:

• reads `wg show` output from files or stdin
• handles one interface with multiple peers
• flags suspicious peer state, `AllowedIPs`, traffic counters, and keepalive hints
• can generate redacted support reports

Release: https://codeberg.org/hniehus/wg-doctor/releases/tag/v0.2.0

I’d really appreciate feedback, especially real-world failure cases and sanitized `wg show` fixtures that can become regression tests.