I have several RUT240 & 241 distributed in remote locations. All of them are connected through a wireguard interface. However, the bandwith does not allow to use the teltonika web gui, therefore i check on them via ssh and cli. How can i set up a new wireguard interface through cli? For now i failed in doing so.
Thanks a lot for the help, it is highly appreciated.
Here are the steps to configure a WireGuard connection and set up the necessary firewall rules on a RUTOS device. If you only need to edit some settings instead of configuring everything from scratch, these steps can serve as a reference as well:
Generate Keys: Generate the public and private keys needed for the connection setup.
Edit the /etc/config/network file to add a new WireGuard interface.
An easier way to get the necessary information is by configuring the desired WireGuard settings via the WebGUI and then copying the information to another device via SSH/CLI.
Add WireGuard Peer: Edit the /etc/config/network file to add a new WireGuard peer.
Configure Firewall: Edit the /etc/config/firewall file to add a new WireGuard firewall zone.
Apply Changes: Restart the network service to apply the changes using the command: /etc/init.d/network restart
Activate WireGuard Interface: Bring up the WireGuard interface with the command: ifup wg0
Verify Status: Check the status of the WireGuard interface with the command: wg show
Quick follow up question: If i ssh into the respective rut241, I have no problem. I can update devices behind the router, and get back messages through the mqtt protocol. If I use the IP in a browser to open up the web gui, I do not even get back the login window. Is there another problem, I have not seen?
To access certain device functionalities remotely, you have to turn them on in System → Administration → Access Control and enable HTTP(S) remote access in this case.
Another question, while I was running your instructions. I have a wg interface already up, and want to set up a second interface (named wg1), so two parties can access the device from separate wg interfaces. Therefore my firewall config file has already options in it. Do I need to replicate rule ‘20’ & ‘21’ with a new wg1-traffic / ‘wg1’? The config zone ‘22’ & ‘23’ remain the same, and i do not have to alter them or replicate, right?
config rule ‘20’
option dest_port ‘51820’
option src ‘wan’
option name ‘Allow-wireguard_wg0-traffic’
option target ‘ACCEPT’
option vpn_type ‘wireguard’
option proto ‘udp’
option family ‘ipv4’