Installing and Using WireGuard - A Complete Guide

What is WireGuard?

WireGuard is a modern, ultra-fast, and secure VPN (Virtual Private Network) protocol that is revolutionizing the way we create VPN tunnels. Unlike traditional solutions such as OpenVPN or IPsec, WireGuard stands out for its simplicity, lightness, and exceptional performance.

Advantages of WireGuard

• Performance: up to 4x faster than OpenVPN.
• Security: modern cryptography and minimal source code (4000 lines vs 400,000 for OpenVPN).
• Simplicity: configuration in a few minutes.
• Compatibility: works on all modern Teltonika routers.

Prerequisites

To follow this tutorial, you will need:

• A Teltonika 4G router (RUT956, RUTX09, RUT240, etc.)
• Administrator access to the router
• An active Internet connection
• A WireGuard client on your device (PC, smartphone, etc.)

Step 1: Installing WireGuard on the Teltonika Router

1.1 Accessing the Administration Interface

Connect to the web interface of your Teltonika router via the default IP address (usually 192.168.1.1).

1.2 Activating WireGuard

1. Navigate to Services → VPN → WireGuard
2. Click on Enable to activate the service
3. Generate a public/private key pair by clicking on Generate Keys

Step 2: Configuring the WireGuard Server

2.1 Server Settings

Configure the following settings:

• Listen Port: 51820 (default port)
• IP Address: 10.0.0.1/24 (internal VPN network)
• Private Key: Automatically generated

2.2 Firewall Rules

Ensure that UDP port 51820 is open in the firewall settings:

1. Go to Network → Firewall → General
2. Add a rule allowing incoming UDP port 51820

Step 3: Configuring the WireGuard Client

3.1 Adding a Peer (Client)

In the router's WireGuard interface:

1. Click on Add Peer
2. Enter the client's public key
3. Set the allowed IP: 10.0.0.2/32
4. Enable Persistent Keepalive: 25 seconds

3.2 Client Configuration (PC/Smartphone)

Create a client configuration file with these settings:

[Interface]PrivateKey = CLIENT_PRIVATE_KEYAddress = 10.0.0.2/24DNS = 8.8.8.8[Peer]PublicKey = ROUTER_PUBLIC_KEYEndpoint = ROUTER_PUBLIC_IP_ADDRESS:51820AllowedIPs = 0.0.0.0/0PersistentKeepalive = 25

Step 4: Testing the Connection

4.1 Activating the Tunnel

1. On your client, import the configuration file
2. Activate the WireGuard connection
3. Verify that you obtain the IP 10.0.0.2

4.2 Verification

Test the connection:

• Ping to 10.0.0.1 (the router)
• Check your public IP (should be the router's)
• Test access to local network resources

Advanced Use Cases

Site-to-Site VPN

Connect multiple remote sites with RUT956 routers to create a secure private network between your facilities.

Remote IoT Access

Use WireGuard to securely access your sensors and IoT equipment, even behind 4G networks with dynamic IP.

4G Redundancy

Dual-SIM models like the RUT956 allow the VPN tunnel to be maintained even in the event of an operator failover.

Troubleshooting

The Tunnel Does Not Connect

• Verify that UDP port 51820 is open
• Check the public/private keys
• Ensure the router's public IP is correct

Unstable Connection

• Increase PersistentKeepalive to 25 seconds
• Check the quality of the 4G signal
• Consider a router with dual SIM for more stability

Performance Optimization

MTU and Performance

To optimize throughput, adjust the MTU to 1420 in the WireGuard interface configuration.

Choosing the Right Router for Your Needs

• Small installations: RUT200 - Compact and economical
• Professional use: RUT240 - Excellent compromise
• Critical environments: RUT956 - Dual SIM, maximum performance
• Industrial deployments: RUTX09 - Extreme robustness

Security and Best Practices

Key Management

• Never share your private keys
• Generate unique keys for each peer
• Securely back up your configurations

Regular Updates

Keep your Teltonika router's firmware up to date to benefit from the latest security enhancements.

Additional Resources

• All our industrial 4G routers
• Official WireGuard documentation
• Teltonika technical support

Need help choosing the right router or configuring WireGuard? Contact our technical team.