Keenetic and WireGuard: Server and Client on One Router — Step-by-Step Guide

Introduction

You’ll configure your Keenetic router to act as a WireGuard server for your devices and simultaneously as a WireGuard client to an external VPN or remote location. This way, you’ll have a personal VPN for remote access to your home network, while the router itself (and selected devices) can route internet traffic through the remote VPN tunnel. This is a practical, beginner-friendly step-by-step guide with sections for advanced users. You’ll get working results without guessing.

Who this guide is for: owners of Keenetic routers running KeeneticOS 3.7+ (also relevant for 4.x) who want to run a WireGuard server and connect the router as a WireGuard client on one device. No prior knowledge required — all steps are clearly explained.

What you should know beforehand: basic IP addressing concepts, what VPN is, and how UDP differs from TCP (briefly: WireGuard works over UDP). If you’re unsure, don’t worry, we’ll explain key ideas in simple terms.

Estimated time: 45–120 minutes for main setup and testing. If you need to reconfigure routing tables and split tunneling, add 20–30 minutes.

Preparation

To avoid issues and speed up the process, have everything ready in advance.

Required Tools and Access

• Keenetic router supporting KeeneticOS 3.7+ and the WireGuard package (typically mid to high-end models; most from 2020–2026 are supported).
• Access to Keenetic’s web interface (usually at my.keenetic.net or via IP, e.g., 192.168.1.1).
• Access to your ISP account or modem settings if you need to forward ports or verify your public IP.
• Smartphone or laptop with a WireGuard client app (official WireGuard app available for iOS/Android/Windows/macOS/Linux) for testing.

System Requirements and Network

• A public ("white") IPv4 address on Keenetic’s WAN, or at least the ability to forward UDP port 51820 to Keenetic (if the router is behind another NAT).
• A free IP range for the WireGuard VPN network, for example, 10.10.10.0/24 (must not overlap with your local network, e.g., 192.168.1.0/24).
• An additional IP for the WireGuard client, e.g., 10.20.20.2/32, if the remote side assigns a /32 (common practice for tunnels).

What to Download/Install

• WireGuard package in KeeneticOS (installed via components section).
• WireGuard client app on your phone or laptop for testing.

Backup Creation

1. Log in to Keenetic’s web interface.
2. Go to "System" → "Configuration" (or "Backup").
3. Click "Save Configuration" and download the file to your computer.

⚠️ Warning: Always create a backup before updating components or changing routing. This lets you quickly revert if something goes wrong.

Tip: Rename backup files with the date and a brief description, e.g., backup-keenetic-2026-05-setup-wg.cfg, to easily find versions later.

Basic Concepts

WireGuard is a lightweight VPN protocol over UDP that uses modern cryptographic keys. It creates a virtual network interface and encrypts traffic between two or more nodes called "peers." Authentication uses key pairs: private (secret) and public (shared with the other side).

• WireGuard Server — a node listening on a fixed UDP port, usually with a static VPN subnet address, e.g., 10.10.10.1.
• WireGuard Client — connects to the server, has its own address in the same subnet, e.g., 10.10.10.2; specifies AllowedIPs — the networks routed through the tunnel.
• AllowedIPs — key routing setting. On the server side, it defines which addresses behind a client are reachable via that peer; on the client side, which networks should route through the tunnel.
• Split Tunnel — some traffic goes through the VPN, some goes directly to the internet. Achieved by setting AllowedIPs and routing/policy rules.
• Port 51820/UDP — default WireGuard port. Changeable if needed.

It’s important to understand that your Keenetic will simultaneously "listen" for incoming connections as a server and initiate outgoing connections as a client. This doesn’t conflict as long as ports, keys, and routes are configured properly.

Step 1: Update Firmware and Install WireGuard Component

Goal: Ensure KeeneticOS is up-to-date and WireGuard module is installed.

1. Log in to Keenetic web interface.
2. Go to "System" → "OS Update" (or "Update").
3. Click "Check for updates." Install if available. Wait for reboot (3–5 minutes).
4. Head to "System" → "Components" (or "Component Management").
5. Find and enable/install "WireGuard VPN" and, if available, "WireGuard Tools."
6. Save and wait for installation. The router may reboot again.

Tip: Update during off-peak hours if you’re worried about losing internet. The whole process usually takes 5–10 minutes including reboot.

✅ Verification: WireGuard package status shows "Installed" in Components. You’ll see a new section for WireGuard connections in the menu.

Common issues and fixes:

• Package won’t install — check available memory; remove unused components and reboot.
• OS update fails — switch temporarily to backup internet channel, check device date/time.

Step 2: Verify Public IP and UDP Port Availability

Goal: Confirm your router is accessible externally on the WireGuard UDP port.

1. In "Internet", check WAN connection status.
2. Note your external IPv4 address. If it starts with 10.x.x.x, 100.64.x.x, 172.16–31.x.x, or 192.168.x.x, it’s a private address, likely CG-NAT.
3. If you’re behind CG-NAT, contact your ISP to get a public IP (static or dynamic) or set up port forwarding on the upstream device if Keenetic is behind another router.
4. Plan ports: by default, the server listens on UDP 51820. If that’s occupied, pick another, e.g., 51821.

⚠️ Warning: Without a public IP (or correct port forwarding), remote clients can’t connect to your WireGuard server. This is a network limitation, not a WireGuard issue.

Tip: If your ISP doesn’t provide public IPv4 but you have IPv6, you could run WireGuard over IPv6, but this guide focuses on IPv4 as the more common case.

✅ Verification: You have your external IPv4 address and know which UDP port you’ll listen on.

Step 3: Plan Addressing and Routing Policies

Goal: Design your IP ranges and traffic flow to avoid conflicts.

1. Identify your LAN subnet, e.g., 192.168.1.0/24. Note Keenetic’s LAN IP (usually 192.168.1.1).
2. Choose a subnet for your WireGuard server, e.g., 10.10.10.0/24; server IP 10.10.10.1/24.
3. Reserve client addresses: 10.10.10.2, 10.10.10.3, etc.
4. Determine the WireGuard client tunnel address on the external VPN, e.g., 10.20.20.2/32 (assigned by remote server or set manually).
5. Decide who routes through the external VPN: the whole router (full tunnel), specific devices (split tunnel), or particular subnets/services.

Tip: If this is your first setup, start simple: route only one test computer and one test website through the remote VPN. It’s easier to troubleshoot.

✅ Verification: You have all IP ranges, addresses, and traffic flows clearly documented.

Step 4: Set Up WireGuard Server on Keenetic

Goal: Enable the WireGuard server on Keenetic, generate keys, assign subnet and port.

1. Go to "VPN Servers" → "WireGuard" (or in some versions "Apps" → "WireGuard Server" or "VPN" → "WireGuard").
2. Click "Add Server" or "Create Profile." Name it, e.g., "wg-home."
3. Select "Generate Keys" or "Create Key Pair." You’ll see public and private keys. Note the server’s public key; keep the private key only on the device.
4. Set interface IP: 10.10.10.1/24 (or your chosen subnet).
5. Set listening port: 51820/UDP (or another you prefer).
6. Save the server profile. Enable or toggle "Activate."

Tip: Some versions offer QR codes for clients here; we’ll cover that in the client addition step. For now, just get the server running.

✅ Verification: The WireGuard server is active, showing interface "wg-home" with IP 10.10.10.1/24, specified port, and status "Enabled."

Common issues and solutions:

• Profile won’t save — check if WireGuard components are installed.
• Address conflicts — if 10.10.10.0/24 clashes with your network or clients, pick another range, like 10.66.66.0/24.

Step 5: Open Port and Configure Server Access

Goal: Ensure your server is reachable from the internet by forwarding ports and (if needed) firewall rules.

1. If your Keenetic has a direct public IPv4, opening ports is usually unnecessary; the server listens on the external interface itself.
2. If there’s another NAT device before Keenetic (router/modem), set up port forwarding there: UDP 51820 to Keenetic’s WAN IP.
3. In Keenetic, check "Security" → "Firewall" → inbound rules. Allow incoming UDP traffic on port 51820 to the server interface (or router depending on the model). Enable any "Allow WireGuard inbound" option if present.
4. Save changes.

⚠️ Warning: Only allow the exact UDP port needed (51820). Don’t open unnecessary ports.

Tip: If your ISP blocks non-standard UDP ports, try changing to port 53/UDP or 443/UDP, but watch for conflicts with DNS/HTTPS proxies and ISP policies. Usually, 51820 works reliably.

✅ Verification: UDP port 51820 is reachable from outside. Test by connecting from another internet source (like mobile data) with a WireGuard client (no AllowedIPs needed yet; we’ll add peers next). Server status should show "Listening."

Step 6: Add Clients to the Server (Phones, Laptops)

Goal: Create peers for your devices, assign IPs, and generate connection configs.

1. In "VPN Servers" → "WireGuard", open your "wg-home" profile.
2. Click "Add Client" or "Add Peer." Name it, e.g., "iphone-ivan."
3. Generate a key pair for the client (or import an existing client public key). Keenetic often auto-generates configs.
4. Assign a client IP, e.g., 10.10.10.2/32. In the server’s AllowedIPs for this peer, specify 10.10.10.2/32 and add your LAN subnet, e.g., 192.168.1.0/24, if the client needs access to home devices. This setting is under AllowedIPs or "Peer Allowed Addresses."
5. If available, use the QR code feature. On the phone, open WireGuard app, tap "+", choose "Scan QR code," and scan. For PC/laptop, export the .conf file.
6. Save the peer. Repeat for other devices (e.g., "laptop-anna" at 10.10.10.3/32, "ipad-oleg" at 10.10.10.4/32).

Tip: In the client config, AllowedIPs define which traffic routes through the tunnel. For home access only, use 10.10.10.0/24 and 192.168.1.0/24. For full tunneling, use 0.0.0.0/0.

✅ Verification: Connect your phone via cellular data and activate the "wg-home" tunnel. In Keenetic, you should see an active peer, with data counters increasing. Access your device’s web interface inside the home network (e.g., 192.168.1.1) — if it loads, access works.

Common issues and fixes:

• Cannot connect from outside — check port forwarding and public IP.
• Connected but no LAN access — add 192.168.1.0/24 to client and server AllowedIPs; check firewall settings and enable routing between wg-home and LAN.
• Connection drops — configure PersistentKeepalive (e.g., 25 seconds) on client to maintain NAT mapping.

Step 7: Configure Keenetic as WireGuard Client to External VPN

Goal: Connect your router (and optionally certain devices) to a remote WireGuard server, such as a second office or VPS.

1. Go to "Internet" → "Other Connections" (or "VPN Clients" → "WireGuard").
2. Click "Add WireGuard Connection." Name it "wg-upstream."
3. Generate a key pair for the Keenetic client or paste an existing private key. Save the Keenetic public key — you'll need to add it as a peer on the remote server.
4. Set the tunnel interface IP on Keenetic, e.g., 10.20.20.2/32 (leave blank if the remote side assigns it; manual setup is simpler).
5. Configure remote peer parameters: PublicKey (remote VPN server's public key), Endpoint (domain or IP:port, e.g., vpn.example.com:51820), AllowedIPs — networks routed through this tunnel. Use 0.0.0.0/0 for full tunnel or list specific subnets for split tunneling like 203.0.113.0/24 or remote office addresses 10.50.0.0/16.
6. Enable PersistentKeepalive 25 seconds if Keenetic is behind NAT.
7. Save and activate the "wg-upstream" connection.

Tip: Importing a ready-made .conf from a commercial VPN or VPS is easier if supported. Otherwise, enter parameters manually, double-checking keys and addresses.

✅ Verification: "wg-upstream" status shows green "Connected," interface IP 10.20.20.2/32, and increasing traffic counters. Ping the remote peer IP via router diagnostics successfully.

Common issues and solutions:

• No handshake — verify public/private keys and input accuracy; a single character error breaks authentication.
• No routes — check AllowedIPs; if empty, traffic won’t go through the tunnel.

Step 8: Set Up Routing and Split Tunnel

Goal: Define which traffic goes where: some through external VPN client, some directly; while keeping the WireGuard server always accessible.

Option A: Full Tunnel for All

1. Set AllowedIPs to 0.0.0.0/0 on "wg-upstream."
2. Enable "Use as default gateway" if available. Or create a routing policy: "All LAN outbound traffic → wg-upstream interface."
3. Exclude the remote server’s domain/IP if needed so the tunnel can come up at startup (usually unnecessary, but helpful in complex setups).

Option B: Split Tunnel for Specific Devices

1. Create a device group or mark specific devices in "Device List."
2. Go to "Internet" → "Routing Rules" (or "Policy Routing," "Network rules," "Traffic classification" — depends on KeeneticOS version).
3. Add a rule: Source = selected devices, Destination = Internet, Preferred gateway = wg-upstream.
4. Create a fallback rule: Other devices → Default gateway (WAN).

Prevent Routing Loops

1. Ensure traffic to your own WireGuard server (wg-home) isn’t routed into wg-upstream by excluding your server’s external IP and local subnets 10.10.10.0/24, 192.168.1.0/24 from policies.
2. Make sure DNS queries from server clients resolve correctly. If using full tunnel on clients, configure DNS via tunnel in client profiles.

Tip: Name rules clearly: "Route: laptop-ivan via wg-upstream," "Exceptions: local subnets via WAN." You’ll thank yourself later.

✅ Verification: Selected devices show the remote VPN’s external IP (check on any IP lookup service), others show your regular ISP IP. Access to wg-home server and LAN remains intact.

Common problems and fixes:

• All traffic goes through tunnel even when not desired — verify default rule order; adjust priority as per KeeneticOS interface.
• No LAN access — add exceptions or ensure client AllowedIPs don’t exclude local subnets.

Step 9: Configure DNS and Security

Goal: Clearly define DNS servers used by clients and router to avoid leaks and name resolution issues.

1. Go to "System" → "DNS" and set "Preferred DNS servers." To have devices routing via wg-upstream use DNS on the remote side (e.g., 10.20.20.1), assign DNS per device via policy rules.
2. For wg-home server clients, specify DNS in their WireGuard profiles (especially if exporting configs), e.g., 192.168.1.1 or 10.10.10.1, if Keenetic runs a DNS proxy.
3. In Firewall, ensure forwarding is allowed between wg-home interface and LAN on required ports. Keenetic usually permits this by default, but some policies may need explicit allowances.
4. Disable unnecessary WAN management services. In "System" → "Access," restrict management to LAN or VPN only.

Tip: For clean split tunneling on server clients, set DNS accessible from your home network (e.g., 192.168.1.1) to properly resolve local device names.

✅ Verification: Server clients can ping local resource names (if you have local DNS), external domains resolve reliably, and DNS leaks are absent (check via DNS leak test from devices routing through wg-upstream).

Common issues and fixes:

• Websites won’t load — check MTU settings (see Advanced Features). Sometimes a smaller MTU like 1420 helps.
• DNS leaks outside the tunnel — enforce DNS policies at device/rule level and disable "Automatic DNS" for specific clients if interface allows.

Result Check

Checklist:

• WireGuard server (wg-home) is active; at least one external device connects (phone).
• Keenetic connects as client (wg-upstream) to remote WireGuard server.
• Routing works: selected devices go through wg-upstream, others use regular internet.
• Client devices can access LAN through the server if planned.
• UDP port 51820 is open from outside (if server listens there).
• DNS resolves correctly; no leaks.

How to test:

1. On your phone using mobile network, enable "wg-home" profile. Access Keenetic’s web interface at 192.168.1.1.
2. From a device set to use wg-upstream, visit an IP check site and confirm you see the remote VPN IP.
3. On another device, confirm your usual ISP IP shows.
4. Ping 10.10.10.1 and 10.20.20.1/remote server address if reachable; check for stable response times.

Signs of success: Consistent WireGuard handshakes, no drops every 20–30 seconds, fast site loads, IP and routing match expectations, wg-home and wg-upstream interfaces show rising byte counters.

Common Issues and Solutions

• Problem: Client can’t connect to server. Cause: Port closed or behind CG-NAT. Fix: Forward UDP 51820, get public IP from ISP, or use an accessible external tunnel.
• Problem: Tunnel connects but no LAN access. Cause: Wrong AllowedIPs or firewall blocking. Fix: Add 192.168.1.0/24 to client AllowedIPs and enable forwarding between wg-home and LAN.
• Problem: All traffic goes through VPN client when split tunnel is intended. Cause: AllowedIPs set to 0.0.0.0/0 and default routing rule. Fix: Restrict AllowedIPs to specific subnets; adjust routing policies accordingly.
• Problem: Slow speeds via WireGuard. Cause: MTU settings, CPU limits, overloaded link. Fix: Set MTU between 1420–1280 on WG interfaces; disable excessive DPI/antivirus; monitor CPU; use nearby server.
• Problem: Connection drops when idle. Cause: NAT timeouts. Fix: Set PersistentKeepalive 25 on client.
• Problem: Address conflicts cause resource access loss. Cause: Overlapping 10.x.x.x subnets. Fix: Change wg-home subnet to a unique range like 10.66.66.0/24.
• Problem: Nothing works after changes. Cause: Routing policy errors. Fix: Restore backup and apply changes step-by-step.

Advanced Features

MTU and Performance

• If sites hang or load slowly, try MTU 1420 on wg-home and wg-upstream interfaces. Sometimes 1380–1280 helps.
• Disable unnecessary traffic analysis packets if CPU is heavily loaded during encryption.

Application and Port Policies

• Create rules like: "Streaming services" → direct internet, "Work resources" → via wg-upstream. This lets you flexibly split tunnel traffic.

Two-Way Access Between Sites

• If wg-upstream connects to your office server, add mutual subnets to AllowedIPs and allow forwarding. This way home and office devices see each other.

CLI for Advanced Users

KeeneticOS offers CLI access via SSH. Commands vary by version. You can create WireGuard interface, set private-key, address, listen-port; add peers with public-key, allowed-ips, endpoint; and configure policy routing. Use built-in help and apply changes stepwise. If unsure about syntax, use the web interface instead.

Logs and Monitoring

• In "System" → "Logs", enable detailed VPN utility logging to diagnose disconnects and NAT timeouts more easily.

Tip: Schedule a nightly restart of wg-upstream if the remote side is unstable. This often improves reliability.

DIY Alternatives for Production

Self-hosting is great if you have time for diagnostics, monitoring, and backups. If you need a quick working setup without console work or VPS rental, services like vpn.how offer personalized VPN servers with dedicated IPs per client, supporting WireGuard, OpenVPN, IKEv2, L2TP, SSTP; servers in Moscow, St. Petersburg, Amsterdam, Frankfurt, London, New York, San Jose, Chicago, Singapore, Sydney, Madrid, Helsinki, Stockholm, Warsaw, Copenhagen, Stavanger; payments accepted via Russian cards (Tinkoff, Ozon), SBP, USDT/BTC; prices from 490₽ daily and 2490₽ monthly with discounts; instant activation after payment; no logs. For use cases needing guaranteed results and minimal manual work, connecting Keenetic as a client to such a service takes minutes, and ongoing maintenance is hassle-free. This isn’t an ad but a practical alternative for time-starved scenarios.

FAQ

Question: Can I have multiple WireGuard servers on one Keenetic on different ports? Answer: Yes, if your model and firmware support it. It’s simpler to create multiple peers under one server with addresses in one subnet. Separate servers are useful for isolation.

Question: Should I choose full tunnel or split tunnel? Answer: For home use, split tunnel usually suffices: work services via VPN, other traffic direct. Full tunnel is handy for privacy on public networks.

Question: What if my ISP blocks UDP? Answer: Try changing the port to 53/UDP or 443/UDP. If that fails, temporarily use TCP-based VPN (e.g., OpenVPN TCP) on the server, and configure Keenetic client accordingly.

Question: Can I access printers/cameras remotely via WireGuard? Answer: Yes. Connect from outside to your wg-home server and access devices by their LAN IPs. Don’t expose device ports directly to the internet.

Question: How to securely share client configs? Answer: Prefer showing QR codes in person or sending .conf files over encrypted channels. Never share server private keys.

Question: What to do about overlapping 10.x.x.x subnets? Answer: Change your VPN subnet to a unique one, e.g., 10.66.66.0/24 or 10.8.0.0/24, and update all client AllowedIPs accordingly.

Question: Is IPv6 supported? Answer: Yes, recent WireGuard and Keenetic versions support IPv6 but require careful prefix and policy setup. This guide focuses on IPv4.

Question: How to limit VPN client speeds? Answer: Use QoS or prioritization policies on Keenetic: set limits per wg-home interface or per device.

Question: Can I block client access to LAN, allowing only internet? Answer: Yes. Don’t add 192.168.1.0/24 to client’s AllowedIPs on the server and block forwarding between wg-home and LAN for that peer.

Question: How to create failover? Answer: Keep a second remote server and a second wg-upstream profile. Set up a failover rule: switch to the backup if the primary fails.

Conclusion

We’ve configured your Keenetic as both a WireGuard server for external devices and client to a remote server. You updated firmware, installed WireGuard, planned addressing, brought up the wg-home server, opened UDP port, added clients, configured the wg-upstream client connection, implemented routing and split tunneling, secured DNS and firewall, then tested and reviewed common issues. Now you can securely connect to your home network from anywhere and selectively route traffic through an external VPN as needed. Moving forward, you can fine-tune MTU, explore IPv6, set up multi-channel failover, and automate via KeeneticOS CLI and API. Congratulations — you now have a fully functional, manageable, and expandable VPN infrastructure all in one box.

Tip: Make it a habit to test any changes first on test rules or devices, then apply network-wide. It saves time and headaches.