What's new

[Experimental] WireGuard for HND platform (4.1.x kernels)

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

Since Wireguard is still a WIP: https://www.wireguard.com/#work-in-progress, i think anyone who can't do it by themselves (eg. searching for or write actual tutorials instead of asking for them) should NOT do anything related to this topic. This is pointless.
You may not be secure, and unknown problems may happen just because.

Basically just stop and wait for v 1.0.
 
Since Wireguard is still a WIP: https://www.wireguard.com/#work-in-progress, i think anyone who can't do it by themselves (eg. searching for or write actual tutorials instead of asking for them) should NOT do anything related to this topic. This is pointless.
You may not be secure, and unknown problems may happen just because.

Basically just stop and wait for v 1.0.
I understand the risks.

It's easy enough to get it working on some other platforms - on my Android phone, for example, it's trivial - and Windows support is apparently coming. But as far as getting it working on my RT-AC86U is concerned, I very much doubt there will ever be a "1.0" product: the author of Asuswrt-Merlin has said, higher up the thread, that he isn't ever going to incorporate Wireguard into the Merlin firmware, and I doubt Asus will ever bother to, so what product do you imagine I should be waiting for?

Scripts are provided in this thread - if someone simply explained what those scripts are supposed to be loaded into or run inside, that would be a good start....
 
so what product do you imagine I should be waiting for?

Wait for wireguard to become stable.
Then and only then someone may at least be a little interested about providing, if not asuswrt then at least an entware package.

You have openvpn. it's way faster if you have ac86u (the only router which supports wireguard). if you have any other router, then openvpn is the only option.

It's pointless to waste time on the beta, but if you really want, go for some of the VPN providers which support wireguard.
 
Entware will never support wireguard.
Entware is a universal repo so they will not provide kernel module for specific device.

I do support it across the kernels/SoC's I support - nice way to get around certain great firewalls..

I'll add that OpenWRT also supports it...

Again, I'm out of the WRT space.... I'm also looking at ZeroTier for certain applications (e.g. science project, aka cafeole)

The Entware team should consider this - it's a bit of work, but once sorted... opps, you don't own the kernel, sorry mates...

Performance is quite nice - see this on RPi3 from someone that has done much more with wg (not my data)

wireguard_comparisions.png
 
Last edited:
There are implementations of user-space wireguard. So possibility isn't totally ruled out. Wg looks cool. However I have doubt in its proliferation.

As Wg's own charts show speed-wise not a generational leap above IPsec. Why would enterprise want to switch? One advantage and the only one I see is not bind to specific well-known ports. That matters less for enterprises.

Also not appealing for great firewall at the moment. Perhaps in future when clients and services are readily available. But then it has to prove speed leap over Shadowsock as well as its "undetectability". Even it plays out this is a rather niche market though non-trivial.
 
If I'm following this correctly, the only router with the hardware requirements of Wireguard is the AC86u, correct? Is it CPU load or kernel based?

I travel often for business (both in the US and International) and have been using a GL-AR300M (https://www.gl-inet.com/products/gl-ar300m/) mini-router as a VPN client to my AC68u at home. It is a fantastically small device but does not have much CPU behind it and my OpenVPN speed is usually in the ~5Mbs to 10Mbs range. I've played with Shadowsocks and on the same connection my speeds are 2x more than OpenVPN. I've seen that Wireguard has even better performance and would like to give that a try if possible.

I picked up an early adopter GL-AR750S (https://www.gl-inet.com/products/gl-ar750s/) which has a built in Wireguard client but if it's hopeless on the AC68u then I won't bother with the frustration of getting it to work... Maybe I'll throw it on one of my servers to play around.

Still, I like to see all these options popping up!
 
For those watching Wireguard -- something to consider from Linux Torvalds himself...

Btw, on an unrelated issue: I see that Jason actually made the pull
request to have wireguard included in the kernel.

Can I just once again state my love for it and hope it gets merged
soon? Maybe the code isn't perfect, but I've skimmed it, and compared
to the horrors that are OpenVPN and IPSec, it's a work of art.

Linus
[/qoute]

If that is not a vote of confidence...
 
Hi
I am using the Merlin code 384.6 with an AC5300, I just signed up with AzireVPN to test Wireguard.
Can it be use as OpenVPN with out having to install any other utility in the router?
Thank you
Mario

Finally managed to set it up and did a speed test.
You are right ... 400+ Mbps is possible.

7246549067.png


At the same time, the CPU use is about 100% on both CPU's.

Wrote a short blog article about this test on my page.
 
Hi
I am using the Merlin code 384.6 with an AC5300, I just signed up with AzireVPN to test Wireguard.
Can it be use as OpenVPN with out having to install any other utility in the router?
Thank you
Mario
You can't run wireguard on RT-AC5300 because of old kernel.
 
I have written a blog with more detailed instructions and a bit updated findings, during my setup.
Especially with the latest WireGuard something must have been changed. The config file needs to be re-build in a different way as in the initial instructions.
The config settings under "Peer" you need to move the Endpoint IP before the Public Key. Otherwise I didn't got the WireGuard connection to work.
[Peer]
Endpoint = xxx.xxx.xxx.xxx:xxxxx
PublicKey = **********
 
I have written a blog with more detailed instructions and a bit updated findings, during my setup.
Especially with the latest WireGuard something must have been changed. The config file needs to be re-build in a different way as in the initial instructions.
The config settings under "Peer" you need to move the Endpoint IP before the Public Key. Otherwise I didn't got the WireGuard connection to work.
So, here's a journal of how I got on with this. (TL;DR: badly).

1) I had to figure out how to enable SSH on the router. :) (Not too hard!)

2) Needed to figure out how PUTTY works. (Again, not too hard!)

3) Couldn't get the router to acknowledge my USB stick as a viable drive. I did some googling and followed the instructions here: https://github.com/RMerl/asuswrt-merlin/wiki/Initialize-OPTWARE - that may or may not have been a good idea...?

4) Took a few minutes to figure out how to get Entware installed, but managed that.

5) The process of getting the router to acknowledge my USB stick involved reformatting it in ext2 format; consequently my Windows PC now doesn't recognise it as a viable drive, meaning it's impossible to copy a downloaded file directly onto it from the PC. What I eventually tried was plugging it into the router, then browsing to the Download\Complete folder under the router in Windows Explorer and copying it there. It then took me a while to find that where that folder is in the directory structure in the SSH shell, but found it eventually.

6) It took me a minute or so to figure out that this command: opkg install wireguard_0.0.20180910-ac28449_aarch64-3.10.ipk only works when run inside the /tmp/mnt/sda1/Download2/Complete folder. :) But wireguard installed successfully (I think).

7) The folder /etc/opt/wireguard doesn't exist. The closest I could find is /tmp/mnt/sda1/entware/etc/wireguard - hoped that might do instead(!).

8) Figured out how to install nano(!), created the .conf file in the above folder, and made the requisite changes.

9) Went to /tmp/mnt/sda1/entware/etc/init.d . Made the specified changes to S50wireguard.

10) Went back to /tmp/mnt/sda1/entware/etc/wireguard and made the changes to wg-up.

11) Checked DNS config: okay.

12) Attempted to run /opt/etc/init.d/S50wireguard start - various errors:
insmod: can't insert '/opt/lib/modules/wireguard.ko': File exists
fopen: No such file or directory
need at least a destination address


13) Tried running /tmp/mnt/sda1/entware/etc/init.d/S50wireguard start instead - same result.

14) Tried editing the line in the wg-up file that points to the .conf file to read
wg setconf wg0 /tmp/mnt/sda1/entware/etc/wireguard/xxx.conf
instead to see if that helped. That actually gives me an extra error:

insmod: can't insert '/opt/lib/modules/wireguard.ko': File exists
Line unrecognized: '[Interface]PrivateKey=xxxxxxxx'
Configuration parsing error
need at least a destination address



So, I'm a bit stuck now. :( Any suggestions as to where I'm going wrong?
 
7) The folder /etc/opt/wireguard doesn't exist.

My fault, the folder is called /opt/etc/wireguard/
I corrected this in the blog now.

12) Attempted to run /opt/etc/init.d/S50wireguard start - various errors:
insmod: can't insert '/opt/lib/modules/wireguard.ko': File exists
fopen: No such file or directory
need at least a destination address


13) Tried running /tmp/mnt/sda1/entware/etc/init.d/S50wireguard start instead - same result.

14) Tried editing the line in the wg-up file that points to the .conf file to read
wg setconf wg0 /tmp/mnt/sda1/entware/etc/wireguard/xxx.conf
instead to see if that helped. That actually gives me an extra error:

insmod: can't insert '/opt/lib/modules/wireguard.ko': File exists
Line unrecognized: '[Interface]PrivateKey=xxxxxxxx'
Configuration parsing error
need at least a destination address



So, I'm a bit stuck now. :( Any suggestions as to where I'm going wrong?

Did you change the in the order in the .conf file?
Under [PEER] the Endpoint address needs to come before the PrivateKey information.

Don't forget to run /"tmp/mnt/sda1/entware/etc/init.d/S50wireguard stop" to really end the WireGaurd task.
Now run "/tmp/mnt/sda1/entware/etc/init.d/S50wireguard start" again and it should work.

Somehow I still have sometimes DNS problems. Also I have seen that my connection dropps totally after max. 48-72 hours and I have to end the WireGuard task, and restart it.
Don't know whether this has with missing DNS settings in the config file to do. But somehow I didn't found any place where to add DNS settings. Maybe the creator of the initial post can say something about this.

/Geraner
 
My fault, the folder is called /opt/etc/wireguard/
I corrected this in the blog now.
OMG, that actually works now! :eek:

Also: holy hell, that's fast! I'm connecting to the AzireVPN wireguard server in the UK. www.speedtest.net results are a 10ms ping with 368Mb/s downstream speed, and 20.17 upstream. With no VPN connection I can hit 390Mb/s downstream, but that kind of slow-down is essentially invisible. Ping and upstream are unaffected.

By contrast, using OpenVPN over TCP, I get around 150Mb/s downstream, with a 16ms ping. (And for some reason OpenVPN over UDP is even slower, my ISP doesn't seem to like it).

Router CPU core 1 hits 94% during the speed test, core 2 gets to about 75%; so I'm not sure if it's even quite hit the router's limit. Very impressive.

It really would be great if there were a more "official" way of doing this. :D
 
One final dumb question: if I want to update to the latest version of Wireguard, which distribution do I want, and where exactly do I click to download it? :confused:
 

Similar threads

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top