Имеем такую схему где Router-1, под управлением OpenWrt, имеет статический внешний IP (допустим 22.33.44.55), Host-1 находится за NAT, но имеет выход в интернет. Требуется обеспечить выход с Host-1 в локальную сеть LAN-1 (192.168.1.0/24), и обратно. т.е. из LAN-1 должен быть выход на Host-1

в консоли роутера:

opkg update
opkg install luci-proto-wireguard luci-app-wireguard wireguard kmod-wireguard wireguard-tools

mkdir wgkeys && cd wgkeys
wg genkey | tee privkey | wg pubkey > publickey

uci add firewall rule
uci set firewall.@rule[-1].src="*"
uci set firewall.@rule[-1].target="ACCEPT"
uci set firewall.@rule[-1].proto="udp"
uci set firewall.@rule[-1].dest_port="4500"
uci set firewall.@rule[-1].name="Allow-Wireguard-Inbound"
uci commit firewall
/etc/init.d/firewall restart

# Add the firewall zone
uci add firewall zone
uci set firewall.@zone[-1].name='vpn'
uci set firewall.@zone[-1].input='ACCEPT'
uci set firewall.@zone[-1].forward='ACCEPT'
uci set firewall.@zone[-1].output='ACCEPT'
uci set firewall.@zone[-1].masq='1'
# Add the WG interface to it
uci set firewall.@zone[-1].network='wg0'
# Forward WAN and LAN traffic to/from it
uci add firewall forwarding
uci set firewall.@forwarding[-1].src='vpn'
uci set firewall.@forwarding[-1].dest='wan'
uci add firewall forwarding
uci set firewall.@forwarding[-1].src='vpn'
uci set firewall.@forwarding[-1].dest='lan'
uci add firewall forwarding
uci set firewall.@forwarding[-1].src='lan'
uci set firewall.@forwarding[-1].dest='vpn'
uci add firewall forwarding
uci set firewall.@forwarding[-1].src='wan'
uci set firewall.@forwarding[-1].dest='vpn'
uci commit firewall
/etc/init.d/firewall restart

# wg0 is the name of the wireguard interface, replace it if you wish.
uci set network.wg0="interface"
uci set network.wg0.proto="wireguard"
uci set network.wg0.private_key="$(cat privkey)"
# You may change this port to your liking, ports of popular services get through more firewalls.
# Just remember it for when you have to configure the firewall later.
uci set network.wg0.listen_port="5400"
uci add_list network.wg0.addresses='192.168.80.1/24'
# Save the changes
uci commit network
/etc/init.d/network reload

Так же настроим часть для пира

uci add network wireguard_wg0
uci set network.@wireguard_wg0[-1].public_key="<public key from Host-1>"
uci add_list network.@wireguard_wg0[-1].allowed_ips="192.168.80.2/32"
uci set network.@wireguard_wg0[-1].persistent_keepalive='25'
uci commit network
/etc/init.d/network reload

sudo add-apt-repository ppa:wireguard/wireguard
sudo apt update
sudo apt upgrade
sudo apt install wireguard-dkms wireguard-tools

(umask 077 && printf "[Interface]\nPrivateKey = " | sudo tee /etc/wireguard/wg0.conf > /dev/null)
wg genkey | sudo tee -a /etc/wireguard/wg0.conf | wg pubkey | sudo tee /etc/wireguard/publickey

при помощи текстового редактора привести файл /etc/wireguard/wg0.conf к следующему виду:

[Interface]
Address = 192.168.80.2/24
SaveConfig = true
ListenPort = 4500
PrivateKey = <Private Key>
 
[Peer]
PublicKey = <Public Key from Router-1>
AllowedIPs = 192.168.1.0/24
Endpoint = 22.33.44.55:4500
PersistentKeepalive = 25

Внимание: Когда SaveConfig = true, сервис wg-quick перезапишет файл /etc/wireguard/wg0.conf при выключении. Если надо отредактировать файл /etc/wireguard/wg0.conf , то сперва нужно остановить сервис:

sudo systemctl stop wg-quick@wg0

Если нужно чтобы туннель поднимался автоматически при загрузке компьютера:

sudo systemctl enable wg-quick@wg0

Запуск сервиса вручную:

sudo systemctl start wg-quick@wg0

Просмотр статистики туннеля

$ sudo wg
interface: wg0
  public key: <Public key>
  private key: (hidden)
  listening port: 4500
  fwmark: 0xca6c
 
peer: <Public Key from Router-1>
  endpoint: 22.33.44.55:4500
  allowed ips: 192.168.1.0/24
  latest handshake: 1 minute, 49 seconds ago
  transfer: 84.88 KiB received, 53.18 KiB sent
  persistent keepalive: every 25 seconds
$ ip addr show wg0
14: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1
    link/none 
    inet 192.168.80.2/24 scope global wg0
       valid_lft forever preferred_lft forever
$