[VPNs]

Leah Whitcombe // March 8, 2026 // 13 min // [en]

Wireguard vpn edgerouter x setup guide for EdgeRouter X: configure WireGuard VPN on EdgeOS for fast, private home networking

Yes, you can run WireGuard VPN on EdgeRouter X. This guide walks you through a practical, friendly approach to getting a WireGuard tunnel up on a budget EdgeRouter X, plus tips for performance, security, and everyday use. You’ll get a step-by-step setup, client configurations, firewall and NAT rules, testing tips, common pitfalls, and a few advanced options like split-tunnel and site-to-site VPN. If you’re a home lab tinkerer or a small office admin, this is the guide you’ll want. And for an extra layer of protection while you test things out, NordVPN is offering a limited-time deal you might want to check out: Useful URLs and Resources plain text, not clickable: - WireGuard official website - https://www.wireguard.com - WireGuard documentation - https://www.wireguard.com/tech - EdgeRouter X product page - https://www.ubnt.com/routers/edge-router-x/ - EdgeOS documentation and help center - https://help.ubnt.com/hc/en-us - EdgeRouter X forums and community guides - https://community.ubnt.com - VPN best practices guide - https://www.reddit.com/r/VPN/wiki/basics - NordVPN official site - https://nordvpn.com - General home networking basics - https://www.homenetworkinginabox.com Introduction overview - What you’ll get: a working WireGuard setup on EdgeRouter X, explained in clear steps, with practical notes on firewalling, NAT, and routing. - Who this is for: home users, remote workers, small offices, or anyone who wants a fast, slim VPN tunnel without heavyweight VPN software on every device. - What you’ll learn: WireGuard concepts, EdgeRouter X specifics, key generation, interface and peer configuration, full tunnel vs split tunnel, NAT rules, firewall rules, client configs, testing, troubleshooting, and performance tips. - Quick take: WireGuard on EdgeRouter X can deliver low-latency, high-speed VPN with minimal CPU overhead, but performance depends heavily on your firmware version, network topology, and how you route and encrypt traffic. - Why WireGuard on EdgeRouter X matters: simple config, robust cryptography, smaller codebase, and better performance than traditional VPN options on underpowered hardware. - Quick-start list step-by-step: 1 Gather prerequisites and keys 2 Create and configure the wg0 interface 3 Add and configure peers servers or clients 4 Set up routing and NAT for LAN traffic 5 Harden firewall rules and test connectivity 6 Rotate keys and maintain updates - Performance note: Expect a wide range of speeds depending on the edge router’s CPU and firmware. typical consumer-grade EdgeRouter X setups can reach hundreds of Mbps with a properly tuned WireGuard tunnel, but real-world numbers vary. - NordVPN chance to boost protection: consider security-minded users who want a user-friendly, audited VPN service on top of your WireGuard setup. see the NordVPN offer above for details. What is WireGuard and why use it on EdgeRouter X? - WireGuard is a modern VPN protocol designed for speed and simplicity. It uses small code, fast cryptography, and minimal handshake overhead, which translates to lower CPU load and higher throughput on capable hardware. - EdgeRouter X is an affordable router that runs EdgeOS. It’s not a “smart mega-router,” but with WireGuard you can create a lean and fast VPN gateway for a small home or office network. - Why EdgeRouter X specifically: its solid routing capabilities, straightforward CLI, and low energy use make it a good candidate for a dedicated VPN tunnel while keeping your LAN devices accessible locally. - Important caveats: EdgeRouter X isn’t a purpose-built VPN appliance with hardware acceleration for WireGuard. Your results depend on CPU load and concurrent connections. For best results, limit the number of peers and keep MTU aligned to avoid fragmentation. Hardware, firmware, and prerequisites - Hardware you’ll want: - EdgeRouter X ER-X with current EdgeOS firmware - A stable LAN network behind the ER-X, typically 192.168.1.0/24 adjust to match your network - An upstream Internet connection with a reasonably stable IP static or dynamic with dynamic DNS - Software you’ll use: - WireGuard on EdgeOS wg0 interface - Generated key pairs for the router and for each peer private/public keys - Optional: a secondary device laptop/phone to act as a WireGuard client - Prerequisites: - SSH or local console access to EdgeRouter X - Basic familiarity with EdgeOS/CLI commands - A plan for your tunnel’s IP addressing e.g., 10.99.0.0/24 for wg0 - Public keys/addresses for the peers you’ll connect to server or another client Step-by-step setup EdgeRouter X Note: Commands shown are representative. If you’re on a different EdgeOS version, some subcommands may vary. Always run “confirm” or review the config before committing if your device is in production. - Step 1: Generate keys do this on a secure machine - On the router, you’ll paste the private key, but you should generate it on a trusted host then copy to the router. - Generate on client/server or use a dedicated key management process: - wg genkey > privatekey - cat privatekey | wg pubkey > publickey - Save these: PRIVATE_KEY_ROUTER, PUBLIC_KEY_ROUTER, PRIVATE_KEY_PEER, PUBLIC_KEY_PEER - Step 2: Enter configuration mode - connect to EdgeRouter X via SSH, then: - configure - Step 3: Create the WireGuard interface on the router - set interfaces wireguard wg0 address 10.10.0.1/24 - set interfaces wireguard wg0 private-key "BASE64_ENCODED_PRIVATE_KEY_ROUTER" - set interfaces wireguard wg0 listen-port 51820 - set interfaces wireguard wg0 description "WG to remote peer" - Step 4: Add a peer remote WireGuard endpoint - set interfaces wireguard wg0 peers peer1 public-key "PEER_PUBLIC_KEY" - set interfaces wireguard wg0 peers peer1 allowed-ips 10.10.0.2/32 - set interfaces wireguard wg0 peers peer1 endpoint-wireguard-endpoint 203.0.113.42:51820 - set interfaces wireguard wg0 peers peer1 persistent-keepalive 25 - Step 5: Create LAN-side routing and NAT to route LAN traffic through WG - Optional: ensure your LAN subnet is 192.168.1.0/24. adjust as needed - set protocols static-route 0.0.0.0/0 next-hop 10.10.0.2 distance 1 - set nat source rule 1000 outbound-interface wg0 - set nat source rule 1000 source-address 192.168.1.0/24 - set nat source rule 1000 translation address masquerade - Step 6: Firewall considerations - Create a WireGuard firewall rule to allow UDP on the listen port - set firewall name WG-INPUT default-action drop - set firewall name WG-INPUT rule 10 action accept - set firewall name WG-INPUT rule 10 protocol udp - set firewall name WG-INPUT rule 10 destination port 51820 - Attach WG-INPUT to the wg0 interface or to the WAN-facing zone, depending on your topology - Step 7: Apply and test - commit - save - exit - On the client side, configure a WireGuard client with: - Private key corresponding to the client - Address 10.10.0.2/24 - Peer public key = ROUTER_PUBLIC_KEY - Allowed-ips = 0.0.0.0/0 full-tunnel or 192.168.1.0/24 split-tunnel - Persistent keepalive = 25 - Step 8: Validate connectivity - On the EdgeRouter: run “show interfaces wireguard” to verify wg0 and peers - On the client: activate the WireGuard tunnel and test with: - ipconfig/ip a or ifconfig to confirm the IP - curl ifconfig.me or icanhazip.com to verify the external IP matches your peer - If you’re routing full-tunnel traffic, test a few sites to verify traffic exits via the VPN - Step 9: Fine-tuning optional - Adjust MTU if you see fragmentation. start at 1420 and tune down if you see issues - Use shorter keepalive for mobile peers to ensure NAT mappings don’t time out e.g., 15-25 seconds - Review and tighten allowed-ips to minimize unnecessary traffic through the tunnel Performance considerations and practical tips - CPU and throughput: EdgeRouter X’s CPU limits the maximum VPN throughput you can sustain. WireGuard’s efficiency helps, but if you push many clients or enormous UDP traffic, speeds may drop below the Ethernet link speed. Expect hundreds of Mbps in typical home setups with a small number of peers. - Tunnel vs. LAN speed: Even if your LAN-to-WAN path is very fast, the VPN path can become the bottleneck. For a small home network, a single tunnel with a single peer is usually fine. for multiple peers or complex routing, you may see more overhead. - MTU and fragmentation: Default MTU values work for most setups, but if you notice slow connections or dropped packets, try reducing MTU by 50–100 bytes and test again. - IPv6: If you don’t need IPv6 over the VPN, disable IPv6 on the WireGuard interface to avoid leaks or misrouted traffic. If you want IPv6 support, ensure proper firewall and routing rules are in place. - Split-tunnel vs full-tunnel: Split-tunnel routes only the necessary subnets through the VPN, preserving local internet access for non-sensitive traffic. Full-tunnel sends all traffic through the VPN. it’s simpler for privacy but can impact performance. - Security hygiene: Use strong keys, rotate keys periodically, and monitor peer activity. Keep EdgeOS firmware updated to ensure you have the latest security patches. Security best practices for WireGuard on EdgeRouter X - Keep private keys secret: never expose router private keys in shared configs. - Use distinct keys per peer: this makes revoking a single peer easy without affecting others. - Enable persistent keepalive for mobile peers: helps maintain NAT mappings across time. - Limit allowed-ips carefully: set the tunnel to carry only the routes you need. - Use a dedicated port or firewall rules: restrict who can reach the WireGuard port to minimize exposure. - Regularly update firmware: EdgeOS updates often include security fixes that matter for VPN functionality. - Consider segmentation: if possible, keep VPN clients and VPN servers on separate subnets to reduce broadcast storms or misconfigurations. Advanced configurations and use cases - Site-to-site VPN between two edge networks - Each side runs a WireGuard interface. you configure peer endpoints with the corresponding allowed-ips for the other LAN. - The result is a private, encrypted bridge between two networks without complex VPN hardware. - Client-to-site access to a home network - Individual client devices connect to wg0 on EdgeRouter X. you route 0.0.0.0/0 or 192.168.1.0/24 via wg0 depending on your needs. - Split-tunnel setup - Route only certain subnets or destinations through wg0. this minimizes VPN load on the EdgeRouter X and preserves local traffic speed. - Remote access for small offices - Use a fixed IP or dynamic DNS at the peer and configure firewall rules to restrict access to specific internal resources. - Combining with a commercial VPN like NordVPN - You can run a WireGuard tunnel for custom needs and still leverage a commercial VPN service for additional privacy or geographic requirements. The NordVPN deal is included in the introduction for convenience and additional protection. Troubleshooting common issues - Issue: Peer not connecting - Check that the public key on both sides matches. verify the endpoint IP/port is reachable. ensure the firewall on EdgeRouter X allows UDP on the listen port. - Issue: Traffic isn’t routing through wg0 - Confirm NAT rules and static routes are set. double-check allowed-ips on peers. verify that the LAN traffic is being sent to wg0 or that policy-based routing is correctly configured. - Issue: DNS leaks or split DNS problems - Ensure the resolver is reachable from the VPN or set a VPN-specific DNS on the client. consider using a DNS server accessible via the VPN tunnel. - Issue: Slow performance - Check MTU and adjust as needed. monitor CPU load. keep the number of active peers small. verify you’re not routing unnecessary traffic through wg0. - Issue: IPv6 issues - Disable IPv6 on the WG interface if not using it. if using IPv6, add proper allowed-ips and firewall rules. - Issue: NAT not working - Re-check NAT source rules and ensure the outbound-interface is wg0. verify the source network matches your LAN. - Issue: Wrong IP addressing - Confirm the tunnel IP ranges don’t overlap with LAN addresses. use non-overlapping subnets for wg0 and the LAN. - Issue: Dynamic IP changes for peer - If the peer uses a dynamic IP, consider a dynamic DNS setup or use a static IP for the peer if possible. - Issue: Key rotation - Rotate keys on both sides and reconfigure peers. ensure old keys are removed to prevent access. - Issue: Backup and disaster recovery - Maintain backed-up, encrypted configuration snapshots. keep private keys secure and archived safely. Maintenance, updates, and best practices - Regular updates: Keep EdgeOS up to date to ensure security fixes and WireGuard improvements are applied. - Keys and rotation: Periodically rotate keys and reissue peer configurations. this reduces the risk of key compromise. - Monitoring: Use logs and status commands to keep an eye on peer health and connection stability. - Scale and future-proofing: If you plan to add more peers or increase traffic, consider evaluating per-peer constraints and potential hardware upgrades, or moving to a more capable EdgeRouter model. - Documentation: Maintain a simple internal doc with your wg0 configuration, peer public keys, endpoint addresses, and the reasons for the chosen allowed-ips. Comparison: WireGuard on EdgeRouter X vs traditional VPN solutions - EdgeRouter X with WireGuard offers a lean, fast alternative to OpenVPN or IPsec on underpowered devices. - Pros: - Simpler configuration in many cases - Higher speed and lower CPU overhead - Better code simplicity and auditability - Cons: - Fewer built-in features for complex VPN topologies compared to enterprise-grade appliances - Hardware limits can cap throughput with multiple peers or heavy traffic - When to choose WireGuard on ER-X: - Small home networks, remote workers, simple site-to-site needs, budget-conscious setups - When to consider alternatives: - Large offices, complex access control, or requirements for advanced VPN features beyond WireGuard basics Frequently Asked Questions # How do I know if my EdgeRouter X supports WireGuard? EdgeRouter X supports WireGuard via EdgeOS, but ensure you’re on a version that includes WireGuard support and follow the official EdgeOS documentation for the specific CLI syntax. # Do I need a static IP to use WireGuard on EdgeRouter X? Not strictly. You can run a peer with a dynamic endpoint and update the peer configuration accordingly. For stable remote endpoints, a static IP is more convenient. # Can I use WireGuard with multiple peers on EdgeRouter X? Yes. You can configure several wg0 peers, each with its own public key and allowed-ips. Just be mindful of CPU and routing complexity. # How do I generate keys for WireGuard? Use wg genkey to generate a private key, then pipe it to wg pubkey to generate the public key. Keep private keys secret and share only public keys with peers. # Is it better to use a full tunnel or split tunnel with WireGuard on ER-X? Split tunnel is often better for home networks because it reduces VPN load and preserves local access for non-VPN traffic. Full tunnel provides privacy for all traffic but increases CPU load. # How do I test if the VPN tunnel is working? Use wg show on the router to verify tunnel status, then connect a client and test with curl ifconfig.me or icanhazip.com to confirm the exit IP. Also test access to LAN resources from the client. # What are best practices for firewall rules with WireGuard on EdgeRouter X? Allow only the WireGuard UDP port e.g., 51820 in the input firewall zone for the WAN, then tightly control which traffic can come through wg0 and access LAN resources. # How do I do site-to-site VPN with EdgeRouter X and WireGuard? Configure wg0 on both sides with each side’s peer public key, endpoint, and allowed-ips for the opposite LAN. Route traffic between the sites via wg0 and ensure proper firewall and NAT rules exist on both ends. # Can I use IPv6 with WireGuard on EdgeRouter X? Yes, but you must configure IPv6 addressing for wg0, add appropriate routes, firewall rules, and ensure there are no leaks. If you don’t need IPv6, disable it on wg0 to simplify setup. # How can I maintain and update this setup over time? Keep EdgeOS firmware current, rotate keys periodically, back up configuration snapshots, monitor the tunnel status, and document any changes you make for future reference. # What if I want to expand beyond EdgeRouter X? If you’re growing or require more throughput, consider upgrading to a higher-end EdgeRouter, or run a dedicated WireGuard host behind your ER-X e.g., a small VPS or Raspberry Pi to extend capabilities while preserving your local network. # Are there performance benchmarks for WireGuard on EdgeRouter X? Benchmarks vary by firmware version and traffic pattern, but WireGuard generally offers higher throughput and lower CPU utilization than traditional VPN protocols on modest hardware. Real-world results depend on the number of peers, traffic mix, and MTU settings. # How do I rotate keys securely without downtime? Plan a maintenance window, generate new key pairs, update the EdgeRouter config to include new public keys, apply the changes, verify connectivity, and remove old keys after confirming that peers connect normally. # What should I do if I upgrade the EdgeRouter model later? Migrate WireGuard configs to the new device by exporting the wg0 configuration, re-importing on the new router, and re-validating all peers, routes, and firewall rules. Always keep a backup of your original config in a secure location.

Note: This guide provides a practical, snake-oil-free approach to getting WireGuard up on EdgeRouter X. Real-world results depend on firmware versions, hardware limits, and how you tune the network. Use the steps as a solid starting point, customize them for your environment, and keep security and maintenance in mind as your VPN usage grows.

Proxy microsoft edge: how to set up proxies, VPNs, and edge browser integration for privacy and access