Menu
What's new
By:
Filters
Better Search

Asus Merlin on Asus ZenWIFI Pro XT12 cant install Entware as USB is required but router doesn't have one.

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

R

rayyan

Occasional Visitor
So today i installed Merlin Fw on my XT12 to get wireguard setup however i need to install entware but it needs to be installed on a usb but the router doesn't have one so what can i do to make this work??

1661463493194.png
 
Welcome to the forums @rayyan.

Buy another router?

Or, wait for the 388.xx firmware where WG may be included from Asus.
 
And where did it state WG would be included, before you bought it?
 
well it didnt state it anywhere bc i when i do amtm i see wireguard so i tried installing it but it dosnt as it needs a usb
 
Yes. User error (assumptions) before purchase.

As I said, it may (no guarantee) be included in the 388.xx firmware that is slowly coming out for various models from Asus.

RMerlin may have a version with WG included sometime around the new year.
 
L&LD said:
Yes. User error (assumptions) before purchase.

As I said, it may (no guarantee) be included in the 388.xx firmware that is slowly coming out for various models from Asus.

RMerlin may have a version with WG included sometime around the new year.
Click to expand...
ahh i c
 
The Wireguard kernel and user space tools are likely already on your router if you have the 386.x Merlin installed. Depending on what you want to do with Wireguard and how comfortable you are in using Wireguard, you can do the scripts yourself in jffs scripts.

The Wireguard utility that Martineau built (that can be installed with AMTM) is a great tool, but it does require Entware because SQLite (among other utilities) are used to manage all the Wireguard configurations. If your setup is simple enough, you can do the work yourself.

I setup a Wireguard Server on my AC86U using just the kernel module and user space tool before the Martineau polished his script.
 
Jeffrey Young said:
The Wireguard kernel and user space tools are likely already on your router if you have the 386.x Merlin installed. Depending on what you want to do with Wireguard and how comfortable you are in using Wireguard, you can do the scripts yourself in jffs scripts.

The Wireguard utility that Martineau built (that can be installed with AMTM) is a great tool, but it does require Entware because SQLite (among other utilities) are used to manage all the Wireguard configurations. If your setup is simple enough, you can do the work yourself.

I setup a Wireguard Server on my AC86U using just the kernel module and user space tool before the Martineau polished his script.
Click to expand...
and how do i do this btw i know to configure wiregaurd and yea
 
OK, so you don't have a USB key, so everything has to go into the /jffs directory. I also start my wireguard server from the Entware startup directory, so we will have to move some commands to your services-start file instead. I've edited my files the best I could to work in your environment, but you may have to do some troubleshooting.

EDIT: For clarity, this setup is for hosting a Wireguard SERVER

First thing into make a wireguard directory in your JFFS partition. I'm assuming /jffs/addons/wireguard

Here is my wireguard.conf file. Yours would be in /jffs/addons/wireguard/wg1.conf

Code: 
## Set Up WireGuard VPN on Asus/Merlin By Editing/Creating wg1.conf File ##
# Peer script used by non wg-quick method of bringing up wire guard on router

[Interface]
ListenPort = 51006
PrivateKey = ***************

[Peer]
## Client 1 ##
PublicKey = ***********
PresharedKey = *************
AllowedIPs = 10.100.10.10/32

Your wireguard startup script /jffs/addons/wireguard/wg-server

EDIT: Changed a path in the wg-server script to work from jffs

Code: 
#!/bin/sh

KERNEL=$(uname -r)
WGaddress=10.100.10.1/24 # Use your WG subnet
WGport=51006 # Use your WG Port

modprobe xt_set
insmod /lib/modules/${KERNEL}/kernel/net/wireguard/wireguard.ko

ip link del dev wg1 2>/dev/null
ip link add dev wg1 type wireguard
wg setconf wg1 /jffs/addons/wireguard/wg1.conf
ip address add dev wg1 $WGaddress
ip link set up dev wg1
ifconfig wg1 mtu 1380 # origional set by setup script
# ifconfig wg1 mtu 1440
ifconfig wg1 txqueuelen 1000

iptables -t mangle -D PREROUTING -i wg1 -j MARK --set-xmark 0x01/0x7 2>/dev/null
iptables -t mangle -D FORWARD -o wg1 -j MARK --set-xmark 0x01/0x7 2>/dev/null
iptables -t mangle -D FORWARD -i wg1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null
iptables -t mangle -D FORWARD -o wg1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null

iptables -D INPUT -p udp --dport $WGport -j ACCEPT 2>/dev/null
iptables -D INPUT -i wg1 -j ACCEPT 2>/dev/null
iptables -D FORWARD -i wg1 -j ACCEPT 2>/dev/null
iptables -D FORWARD -o wg1 -j ACCEPT 2>/dev/null
iptables -D OUTPUT -o wg1 -j ACCEPT 2>/dev/null
iptables -t nat -D PREROUTING -p udp --dport $WGport -j ACCEPT 2>/dev/null

iptables -t mangle -I FORWARD -o wg1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -I FORWARD -i wg1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -I FORWARD -o wg1 -j MARK --set-xmark 0x01/0x7
iptables -t mangle -I PREROUTING -i wg1 -j MARK --set-xmark 0x01/0x7

iptables -I INPUT -p udp --dport $WGport -j ACCEPT
iptables -I INPUT -i wg1 -j ACCEPT
iptables -I FORWARD -i wg1 -j ACCEPT
iptables -I FORWARD -o wg1 -j ACCEPT
iptables -I OUTPUT -o wg1 -j ACCEPT
iptables -t nat -I PREROUTING -p udp --dport $WGport -j ACCEPT

You may need to check where the wireguard kernel is stored on your router. In helping another fella get UPS NUT working, we found out that the kernel modules are not in the same spot across all routers.

Since a firewall restart will wipe out iptables rules out, we will need a /jffs/scripts/nat-start file and place the following in it

Code: 
#!/bin/sh

WVPNROUTE=`ip route show | grep -i -a "dev wg"`
logger -s -t "($(basename $0))" $$ "Checking if WireGuard is UP...."$WVPNROUTE
if [ "$WVPNROUTE" != "" ];then
           logger -s -t "($(basename $0))" $$ "**Warning WireGuard is UP.... restarting WireGuard"
           /jffs/addons/wireguard/wg-down
           /jffs/addons/wireguard/wg-server
fi

Now, to start your server when the router starts, add the following code to your /jffs/scripts/services-start

Code: 
#!/bin/sh

logger "Starting WireGuard service."
/jffs/addons/wireguard/wg-server

Make sure all the files have the proper execute permissions. Good idea to restrict read permission also to just the root user (your router admin).

Also make sure your have scripts enabled in the router GUI.

Lastly, if the wg-down script is

Code: 
#!/bin/sh

WGaddress=10.100.10.1/24 # Use your WG subnet
WGport=51006 # Use your WG Port

rmmod wireguard 2>/dev/null

#server

iptables -t mangle -D PREROUTING -i wg1 -j MARK --set-xmark 0x01/0x7 2>/dev/null
iptables -t mangle -D FORWARD -o wg1 -j MARK --set-xmark 0x01/0x7 2>/dev/null
iptables -t mangle -D FORWARD -i wg1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null
iptables -t mangle -D FORWARD -o wg1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null

iptables -D INPUT -p udp --dport $WGport -j ACCEPT 2>/dev/null
iptables -D INPUT -i wg1 -j ACCEPT 2>/dev/null
iptables -D FORWARD -i wg1 -j ACCEPT 2>/dev/null
iptables -D FORWARD -o wg1 -j ACCEPT 2>/dev/null
iptables -D OUTPUT -o wg1 -j ACCEPT 2>/dev/null
iptables -t nat -D PREROUTING -p udp --dport $WGport -j ACCEPT 2>/dev/null

exit 0

Let me know how things work out. Very much interested. Like I said, I modified these scripts as well as I could for your environment, but I could not test them.

EDIT2: It took me some time to find the author here that helped me set this up, but I finally did. Tons of credit to @Odkrys for his original work on this project.
 
Last edited:
Jeffrey Young said:
OK, so you don't have a USB key, so everything has to go into the /jffs directory. I also start my wireguard server from the Entware startup directory, so we will have to move some commands to your services-start file instead. I've edited my files the best I could to work in your environment, but you may have to do some troubleshooting.

First thing into make a wireguard directory in your JFFS partition. I'm assuming /jffs/addons/wireguard

Here is my wireguard.conf file. Yours would be in /jffs/addons/wireguard/wg1.conf

Code: 
## Set Up WireGuard VPN on Asus/Merlin By Editing/Creating wg1.conf File ##
# Peer script used by non wg-quick method of bringing up wire guard on router

[Interface]
ListenPort = 51006
PrivateKey = ***************

[Peer]
## Client 1 ##
PublicKey = ***********
PresharedKey = *************
AllowedIPs = 10.100.10.10/32

Your wireguard startup script /jffs/addons/wireguard/wg-server

EDIT: Changed a path in the wg-server script to work from jffs

Code: 
#!/bin/sh

KERNEL=$(uname -r)
WGaddress=10.100.10.1/24 # Use your WG subnet
WGport=51006 # Use your WG Port

modprobe xt_set
insmod /lib/modules/${KERNEL}/kernel/net/wireguard/wireguard.ko

ip link del dev wg1 2>/dev/null
ip link add dev wg1 type wireguard
wg setconf wg1 /jffs/addons/wireguard/wg1.conf
ip address add dev wg1 $WGaddress
ip link set up dev wg1
ifconfig wg1 mtu 1380 # origional set by setup script
# ifconfig wg1 mtu 1440
ifconfig wg1 txqueuelen 1000

iptables -t mangle -D PREROUTING -i wg1 -j MARK --set-xmark 0x01/0x7 2>/dev/null
iptables -t mangle -D FORWARD -o wg1 -j MARK --set-xmark 0x01/0x7 2>/dev/null
iptables -t mangle -D FORWARD -i wg1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null
iptables -t mangle -D FORWARD -o wg1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null

iptables -D INPUT -p udp --dport $WGport -j ACCEPT 2>/dev/null
iptables -D INPUT -i wg1 -j ACCEPT 2>/dev/null
iptables -D FORWARD -i wg1 -j ACCEPT 2>/dev/null
iptables -D FORWARD -o wg1 -j ACCEPT 2>/dev/null
iptables -D OUTPUT -o wg1 -j ACCEPT 2>/dev/null
iptables -t nat -D PREROUTING -p udp --dport $WGport -j ACCEPT 2>/dev/null

iptables -t mangle -I FORWARD -o wg1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -I FORWARD -i wg1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -I FORWARD -o wg1 -j MARK --set-xmark 0x01/0x7
iptables -t mangle -I PREROUTING -i wg1 -j MARK --set-xmark 0x01/0x7

iptables -I INPUT -p udp --dport $WGport -j ACCEPT
iptables -I INPUT -i wg1 -j ACCEPT
iptables -I FORWARD -i wg1 -j ACCEPT
iptables -I FORWARD -o wg1 -j ACCEPT
iptables -I OUTPUT -o wg1 -j ACCEPT
iptables -t nat -I PREROUTING -p udp --dport $WGport -j ACCEPT

You may need to check where the wireguard kernel is stored on your router. In helping another fella get UPS NUT working, we found out that the kernel modules are not in the same spot across all routers.

Since a firewall restart will wipe out iptables rules out, we will need a /jffs/scripts/nat-start file and place the following in it

Code: 
#!/bin/sh

WVPNROUTE=`ip route show | grep -i -a "dev wg"`
logger -s -t "($(basename $0))" $$ "Checking if WireGuard is UP...."$WVPNROUTE
if [ "$WVPNROUTE" != "" ];then
           logger -s -t "($(basename $0))" $$ "**Warning WireGuard is UP.... restarting WireGuard"
           /jffs/addons/wireguard/wg-down
           /jffs/addons/wireguard/wg-server
fi

Now, to start your server when the router starts, add the following code to your /jffs/scripts/services-start

Code: 
#!/bin/sh

logger "Starting WireGuard service."
/jffs/addons/wireguard/wg-server

Make sure all the files have the proper execute permissions. Good idea to restrict read permission also to just the root user (your router admin).

Also make sure your have scripts enabled in the router GUI.

Lastly, if the wg-down script is

Code: 
#!/bin/sh

WGaddress=10.100.10.1/24 # Use your WG subnet
WGport=51006 # Use your WG Port

rmmod wireguard 2>/dev/null

#server

iptables -t mangle -D PREROUTING -i wg1 -j MARK --set-xmark 0x01/0x7 2>/dev/null
iptables -t mangle -D FORWARD -o wg1 -j MARK --set-xmark 0x01/0x7 2>/dev/null
iptables -t mangle -D FORWARD -i wg1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null
iptables -t mangle -D FORWARD -o wg1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null

iptables -D INPUT -p udp --dport $WGport -j ACCEPT 2>/dev/null
iptables -D INPUT -i wg1 -j ACCEPT 2>/dev/null
iptables -D FORWARD -i wg1 -j ACCEPT 2>/dev/null
iptables -D FORWARD -o wg1 -j ACCEPT 2>/dev/null
iptables -D OUTPUT -o wg1 -j ACCEPT 2>/dev/null
iptables -t nat -D PREROUTING -p udp --dport $WGport -j ACCEPT 2>/dev/null

exit 0

Let me know how things work out. Very much interested. Like I said, I modified these scripts as well as I could for your environment, but I could not test them.

EDIT2: It took me some time to find the author here that helped me set this up, but I finally did. Tons of credit to @Odkrys for his original work on this project.
Click to expand...
i cant get it to work i got the dump of the jffs partion is it okay if you can check it out if its okay

backup_jffs (1) – Google Drive

drive.google.com drive.google.com

all im trying to do is set up wireguard as a client to make my network secure with a VPN on
 
Last edited:
@rayyan

Some things to check;

1. Verify that the wireguard.ko kernel module actually exists at the path given in the wg-server file. If the module is not there, it may be hiding somewhere else (use find /lib -name wireguard.ko). If the kernel module is not there, then the rest of the exercise is pointless.

2. You have named your wg-server script wg-server.sh in /jffs/addons/wireguard. If you want to keep this file name, you need to edit /jffs/scripts/services-start and change the wg-server name there as well. You will need to change the name in /jffs/scripts/nat-start as well. Otherwise, get rid of the .sh extention.

3. Your nat-start file in /jffs/scripts is misspelled (you have nat-star).

4. The wg-down script should be in /jffs/addons/wireguard (currently you have it in /jffs/scripts).

5. For the wg1.conf file, you have not replaced the preshared key with a properly generated preshared key. If you don't use preshared keys, remove this line from the file.

6. Depending on how you created these files, you may need to use dos2unix utility to change the line feeds characters to unix style (should not be needed if you used nano right in the shell).

7. Make sure you have the execute permission set on the services-start, nat-start, wg-server, and wg-down scripts (chmod u+x <files>)

From the shell prompt, run the wg-server from the command line (./wg-server) and see what errors you get.
 
Last edited:
Jeffrey Young said:
@rayyan

Some things to check;

1. Verify that the wireguard.ko kernel module actually exists at the path given in the wg-server file. If the module is not there, it may be hiding somewhere else (use find /lib -name wireguard.ko). If the kernel module is not there, then the rest of the exercise is pointless.

2. You have named your wg-server script wg-server.sh in /jffs/addons/wireguard. If you want to keep this file name, you need to edit /jffs/scripts/services-start and change the wg-server name there as well. You will need to change the name in /jffs/scripts/nat-start as well. Otherwise, get rid of the .sh extention.

3. Your nat-start file in /jffs/scripts is misspelled (you have nat-star).

4. The wg-down script should be in /jffs/addons/wireguard (currently you have it in /jffs/scripts).

5. For the wg1.conf file, you have not replaced the preshared key with a properly generated preshared key. If you don't use preshared keys, remove this line from the file.

6. Depending on how you created these files, you may need to use dos2unix utility to change the line feeds characters to unix style (should not be needed if you used nano right in the shell).

7. Make sure you have the execute permission set on the services-start, nat-start, wg-server, and wg-down scripts (chmod u+x <files>)

From the shell prompt, run the wg-server from the command line (./wg-server) and see what errors you get.
Click to expand...


Home@ZenWiFi_Pro_XT12-DD10:/jffs/addons/wireguard# ./wg-server
insmod: can't insert '/lib/modules/4.19.183/kernel/net/wireguard/wireguard.ko': File exists
Home@ZenWiFi_Pro_XT12-DD10:/jffs/addons/wireguard# find /lib -name wireguard.ko
/lib/modules/4.19.183/kernel/net/wireguard/wireguard.ko
Home@ZenWiFi_Pro_XT12-DD10:/jffs/addons/wireguard#
 
rayyan said:
insmod: can't insert '/lib/modules/4.19.183/kernel/net/wireguard/wireguard.ko': File exists
Click to expand...

That just means that the module has already been inserted into the kernel. You can ignore it. The wireguard.ko module either got loaded in your previous troubleshooting efforts, or Asus is now loading it by default. Either way, you got no other errors.

If you run ip addr show | grep wg1, you should see the wg1 interface.
 
Something like this;

Code: 
ClientAdmin@RTAC86U:/tmp/home/root# ip addr show | grep wg1
22: wg1: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1380 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 10.100.10.1/24 scope global wg1

If you don't see that, edit the wg-server script and put the line set -x right after the shebang line (#!/bin/sh) and rerun the script. That will print extra verbose info as the script runs so you can see what is going on
 
Jeffrey Young said:
Something like this;

Code: 
ClientAdmin@RTAC86U:/tmp/home/root# ip addr show | grep wg1
22: wg1: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1380 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 10.100.10.1/24 scope global wg1

If you don't see that, edit the wg-server script and put the line set -x right after the shebang line (#!/bin/sh) and rerun the script. That will print extra verbose info as the script runs so you can see what is going on
Click to expand...
ASUSWRT-Merlin XT12 386.7_2 Sun Jul 24 21:37:08 UTC 2022
Home@ZenWiFi_Pro_XT12-DD10:/tmp/home/root# ip addr show | grep wg1
35: wg1: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1380 qdisc noqueue state UNKNOWN group default qlen 1000
inet 10.100.10.1/24 scope global wg1
Home@ZenWiFi_Pro_XT12-DD10:/tmp/home/root#

yea i got the same thing as you but the main question is how do i connect to a vpn over wg as i have no wg client option on web UI soo how would i connect to a server? aslo i done the set -x thing and the output is below


Home@ZenWiFi_Pro_XT12-DD10:/jffs/addons/wireguard# ./wg-server
+ uname -r
+ KERNEL=4.19.183
+ WGaddress=10.100.10.1/24
+ WGport=51006
+ modprobe xt_set
+ insmod /lib/modules/4.19.183/kernel/net/wireguard/wireguard.ko
insmod: can't insert '/lib/modules/4.19.183/kernel/net/wireguard/wireguard.ko': File exists
+ ip link del dev wg1
+ ip link add dev wg1 type wireguard
+ wg setconf wg1 /jffs/addons/wireguard/wg1.conf
+ ip address add dev wg1 10.100.10.1/24
+ ip link set up dev wg1
+ ifconfig wg1 mtu 1380
+ ifconfig wg1 txqueuelen 1000
+ iptables -t mangle -D PREROUTING -i wg1 -j MARK --set-xmark 0x01/0x7
+ iptables -t mangle -D FORWARD -o wg1 -j MARK --set-xmark 0x01/0x7
+ iptables -t mangle -D FORWARD -i wg1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+ iptables -t mangle -D FORWARD -o wg1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+ iptables -D INPUT -p udp --dport 51006 -j ACCEPT
+ iptables -D INPUT -i wg1 -j ACCEPT
+ iptables -D FORWARD -i wg1 -j ACCEPT
+ iptables -D FORWARD -o wg1 -j ACCEPT
+ iptables -D OUTPUT -o wg1 -j ACCEPT
+ iptables -t nat -D PREROUTING -p udp --dport 51006 -j ACCEPT
+ iptables -t mangle -I FORWARD -o wg1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+ iptables -t mangle -I FORWARD -i wg1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+ iptables -t mangle -I FORWARD -o wg1 -j MARK --set-xmark 0x01/0x7
+ iptables -t mangle -I PREROUTING -i wg1 -j MARK --set-xmark 0x01/0x7
+ iptables -I INPUT -p udp --dport 51006 -j ACCEPT
+ iptables -I INPUT -i wg1 -j ACCEPT
+ iptables -I FORWARD -i wg1 -j ACCEPT
+ iptables -I FORWARD -o wg1 -j ACCEPT
+ iptables -I OUTPUT -o wg1 -j ACCEPT
+ iptables -t nat -I PREROUTING -p udp --dport 51006 -j ACCEPT
Home@ZenWiFi_Pro_XT12-DD10:/jffs/addons/wireguard#
 
So, what we have done so far is made your router into a VPN server. You can now VPN into your home network when you are away and access your home resources. You just need to create peer keys for the folks you want to have access. The clients in this case would be wireguard clients on other computers that you want to be able to access your network while away from home.

Now, it sounds like what you really wanted (and maybe I misunderstood your intent in the beginning) is to use Wireguard to actually VPN out from your router to another service right? If this is the case, the basic setup is the same. You just need to set up your peer/server information in wg1.conf to match what your provider has given you. After that, we will have to come up with different firewall and routing rules depending on what exactly you want to do. I would have to do some research myself, but I don't imagine it will be too difficult. It is just a matter of changing the wg-server script to setup the right rules (firewall and routes).

Also, thinking more about this. We may not need the services-start script. As long as the nat-start script gets run on boot up of the router, then the wg-server script is going to get called anyway from nat-start.
EDIT: On review and second thought, the nat-start script checks first if the wg interface is up. So we still need the services-start script to start the wg interface first.

Maybe tell me exactly what you are trying to do with Wireguard and we can see if we can get things set up. I am open to do some learning.
 
Last edited:
Jeffrey Young said:
So, what we have done so far is made your router into a VPN server. You can now VPN into your home network when you are away and access your home resources. You just need to create peer keys for the folks you want to have access. The clients in this case would be wireguard clients on other computers that you want to be able to access your network while away from home.

Now, it sounds like what you really wanted (and maybe I misunderstood your intent in the beginning) is to use Wireguard to actually VPN out from your router to another service right? If this is the case, the basic setup is the same. You just need to set up your peer/server information in wg1.conf to match what your provider has given you. After that, we will have to come up with different firewall and routing rules depending on what exactly you want to do. I would have to do some research myself, but I don't imagine it will be too difficult. It is just a matter of changing the wg-server script to setup the right rules (firewall and routes).

Also, thinking more about this. We may not need the services-start script. As long as the nat-start script gets run on boot up of the router, then the wg-server script is going to get called anyway from nat-start.

Maybe tell me exactly what you are trying to do with Wireguard and we can see if we can get things set up. I am open to do some learning.
Click to expand...
so what im trying to do is protect every device with a vpn connection for example like i have my pc connected to surfshark so instead of downloading the app on every single device id rather have all trafic going thought the router via a vpn like setting a openvpn client on the router but with wireguard as its faster so i want to add this config file to the router instead u can also use this if u want
 
Alright, we can do this. So we are going to have to do some changes. We are going to use this post for some guidance.

www.snbforums.com

[Experimental] WireGuard for HND platform (4.1.x kernels)

1. Install WireGuard You need Entware-aarch64-3.10 to use wireguard without a new firmware build. ㅡ Kernel Module ㅡ RT-AC86U, GT-AC2900 - 4.1.27 https://github.com/odkrys/entware-makefile-for-merlin/raw/main/wireguard-kernel_1.0.20210219-k27_1_aarch64-3.10.ipk opkg install...
www.snbforums.com www.snbforums.com

Give me a bit to wrap my head around what we need to do to get this working (basiclly, we have to rework things to make it work from jffs partition instead of the Entware.

The file you posted has sensitive info. Please delete it asap so that others can not take advantage of you. I got what I need to help create a setup. You may need to give me a day or two.
 
Jeffrey Young said:
Alright, we can do this. So we are going to have to do some changes. We are going to use this post for some guidance.

www.snbforums.com

[Experimental] WireGuard for HND platform (4.1.x kernels)

1. Install WireGuard You need Entware-aarch64-3.10 to use wireguard without a new firmware build. ㅡ Kernel Module ㅡ RT-AC86U, GT-AC2900 - 4.1.27 https://github.com/odkrys/entware-makefile-for-merlin/raw/main/wireguard-kernel_1.0.20210219-k27_1_aarch64-3.10.ipk opkg install...
www.snbforums.com www.snbforums.com

Give me a bit to wrap my head around what we need to do to get this working (basiclly, we have to rework things to make it work from jffs partition instead of the Entware.

The file you posted has sensitive info. Please delete it asap so that others can not take advantage of you. I got what I need to help create a setup. You may need to give me a day or two.
Click to expand...
yea sure man take your time and im here for testing btw i really appreciate it man thanks bro
 
You must log in or register to reply here.

Similar threads

Implement3443
RT-AX88U Pro vs ZenWiFi Pro XT12
Replies
5
Views
2K
Implement3443
Implement3443
staralfur12
I have an old Brother HL-2300D, and an Asus AX86U. How do I achieve AirPrint?
Replies
18
Views
748
Siff
Siff
B
XT12 and ET12 for Mesh? Cant Find XT12
Replies
4
Views
973
Tech9
Tech9
Z
Solved Accidentally flashed XT12 latest merlin on a ET12 Asus Zenwifi Pro. Can't flash back stock FW.
Replies
11
Views
2K
zapahacks
Z
H
Asus RT-AX58U v2 Merlin: Route all traffic to Pi-hole (running directly on router itself)
Replies
12
Views
524
bidh
B
Similar threads
Thread starter Title Forum Replies Date
A Duckdns on Asus merlin router Asuswrt-Merlin 1
P Accessing remotly Server While Using VPN on Asus Router with Merlin Firmware Asuswrt-Merlin 9
B Unable to establish VPN connection to my PiVPN (ovpn) from my Asus RT-AC86U running Asuswrt-Merlin 386.14 Asuswrt-Merlin 1
H Asus RT-AX58U v2 Merlin: Route all traffic to Pi-hole (running directly on router itself) Asuswrt-Merlin 12
K How to block LAN access for a wired device on ASUS Merlin (Firmware 3004.388.8_2)? Asuswrt-Merlin 12
N AiMesh, router stock asus, wired AP merlin. Cant connect to AP 5ghz Asuswrt-Merlin 4
D Comcast email - RT-AX86U Pro - ASUS 3.0.0.6.102_34314 works, Merlin 3004_388.8_2 doesn't Asuswrt-Merlin 16
J Asus GT-BE98 Pro and Merlin, no internet when VPN disabled Asuswrt-Merlin 4
K GT-BE98 Asus Merlin Asuswrt-Merlin 2
Just Plain Dave ASUS XD5 firmware - Merlin compatible? Asuswrt-Merlin 6

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Staff online

Members online

Total: 745 (members: 29, guests: 716)
Top