Configure WireGuard Interface headless

[rut241]

Hi everyone

I have several RUT240 & 241 distributed in remote locations. All of them are connected through a wireguard interface. However, the bandwith does not allow to use the teltonika web gui, therefore i check on them via ssh and cli. How can i set up a new wireguard interface through cli? For now i failed in doing so.

Thanks a lot for the help, it is highly appreciated.

Kind regards

[Marijus]

Hello,

Here are the steps to configure a WireGuard connection and set up the necessary firewall rules on a RUTOS device. If you only need to edit some settings instead of configuring everything from scratch, these steps can serve as a reference as well:

1. Generate Keys: Generate the public and private keys needed for the connection setup.
   

   

2. Configure WireGuard Interface:

   • Edit the /etc/config/network file to add a new WireGuard interface.
     

   • An easier way to get the necessary information is by configuring the desired WireGuard settings via the WebGUI and then copying the information to another device via SSH/CLI.

3. Add WireGuard Peer: Edit the /etc/config/network file to add a new WireGuard peer.
   

4. Configure Firewall: Edit the /etc/config/firewall file to add a new WireGuard firewall zone.
   

5. Apply Changes: Restart the network service to apply the changes using the command: /etc/init.d/network restart

6. Activate WireGuard Interface: Bring up the WireGuard interface with the command: ifup wg0

7. Verify Status: Check the status of the WireGuard interface with the command: wg show

Best regards,

[rut241]

Thanks a lot, i will follow your instructions.

Quick follow up question: If i ssh into the respective rut241, I have no problem. I can update devices behind the router, and get back messages through the mqtt protocol. If I use the IP in a browser to open up the web gui, I do not even get back the login window. Is there another problem, I have not seen?

Thanks a lot in advance.

[Marijus]

Hello,

To access certain device functionalities remotely, you have to turn them on in System → Administration → Access Control and enable HTTP(S) remote access in this case.

Best regards,

[rut241]

Another question, while I was running your instructions. I have a wg interface already up, and want to set up a second interface (named wg1), so two parties can access the device from separate wg interfaces. Therefore my firewall config file has already options in it. Do I need to replicate rule ‘20’ & ‘21’ with a new wg1-traffic / ‘wg1’? The config zone ‘22’ & ‘23’ remain the same, and i do not have to alter them or replicate, right?

config rule ‘20’
option dest_port ‘51820’
option src ‘wan’
option name ‘Allow-wireguard_wg0-traffic’
option target ‘ACCEPT’
option vpn_type ‘wireguard’
option proto ‘udp’
option family ‘ipv4’

config zone ‘21’
option name ‘wireguard’
option masq ‘1’
option input ‘ACCEPT’
option forward ‘REJECT’
option network ‘wg0’
option output ‘ACCEPT’

config forwarding ‘22’
option dest ‘lan’
option src ‘wireguard’

config forwarding ‘23’
option dest ‘wireguard’
option src ‘lan’

[Marijus]

Hello,

You don’t need to change the firewall settings. Just add a new WireGuard interface and peer entries to the /etc/config/network file.

Best regards,