WireGuard Mesh Manager automates the creation and management of WireGuard mesh VPN networks on OpenWrt routers. It simplifies peer management, configuration generation, and network monitoring.
- Mesh Manager (Core): Handles WireGuard mesh networking - peer management, config generation, connectivity
- Discovery (Optional): Adds device discovery across your mesh - find printers, NAS, cameras, with DNS integration
Any router running:
- OpenWrt 19.07 or newer
- Gargoyle firmware
- Other Linux-based firmware with WireGuard support
Minimum specs: 16MB flash, 128MB RAM
Yes, but:
- Test thoroughly in your environment first
- Keep backups of configurations
- Monitor health regularly
- Review security settings
opkg update
opkg install wireguard-tools kmod-wireguardYes, install the Mesh Manager on every router that will be part of the mesh.
Yes, if running OpenWrt or a compatible Linux distribution with WireGuard support.
mesh-backup
# Install new version
./install.sh
mesh-recover --latest # If neededUse a private range that doesn't conflict with your existing networks:
10.99.0.0/24(recommended default)172.16.99.0/24192.168.99.0/24
Default: UDP 51820. You can change this during mesh-init.
Yes, use your DDNS hostname as the endpoint:
mesh-add mysite fixed 10.99.0.1/24 mysite.ddns.net:51820 --public-key KEYUse persistent-keepalive to maintain the connection:
mesh-add nat-site fixed 10.99.0.5/24 natsite.ddns.net:51820 \
--public-key KEY \
--persistent-keepalive 25Common causes:
- Firewall: Port 51820/UDP must be open
- Wrong endpoint: Verify public IP/hostname
- Key mismatch: Double-check public keys
- NAT issues: Use persistent-keepalive
Run mesh-health for diagnostics.
mesh-status # Overview
mesh-health # Detailed health check
wg show # WireGuard status
ping 10.99.0.X # Test connectivityYes, modify allowed-ips to include 0.0.0.0/0, but this requires careful firewall configuration to avoid routing loops.
- Check MTU settings (try 1420)
- Verify no packet fragmentation
- Check CPU usage on routers
- WireGuard itself adds minimal overhead (~4%)
Yes, WireGuard provides strong encryption (ChaCha20, Poly1305, Curve25519).
- Generate new keys on the peer
- Update the peer in mesh:
mesh-update peer --public-key NEW_KEY - Regenerate and apply:
mesh-generate && mesh-apply-local
Yes, but:
- Encrypt backups
- Store securely
- Limit access
Use mesh-backup --encrypt for encrypted backups.
WireGuard traffic is encrypted end-to-end. Without the private keys, traffic cannot be decrypted.
- Printers (HP, Canon, Epson, Brother)
- NAS devices (Synology, QNAP)
- Cameras (Hikvision, Dahua)
- Any device responding to ARP, mDNS, or NMAP scans
Discovered devices get DNS names like printer-50.mesh. Configure your clients to use the mesh router as DNS.
Yes, discoveries are synchronized across the mesh network.
After installation, access http://router-ip/wg-mesh-discovery/
Run mesh-init first to set up the mesh configuration.
Use mesh-update to modify existing peers, or mesh-remove then mesh-add.
- Verify both sides have each other's correct public keys
- Check firewall allows UDP 51820
- Verify endpoint is reachable
- Check system time is synchronized
After modifying peers:
mesh-generate
mesh-apply-localmesh-backup # Save current config
rm -rf /etc/wg-mesh
mesh-initYes, but mesh-manager manages its own interface. You can run both separately.
mesh-add peer fixed 10.99.0.5/24 endpoint:51820 \
--public-key KEY \
--allowed-ips "10.99.0.5/32,192.168.5.0/24,10.0.0.0/8"Yes, script the mesh-add commands or directly modify /etc/wg-mesh/peers.db.
Use mesh-health --json or mesh-stats --json for machine-readable output.
- Check this FAQ
- Read the Troubleshooting Guide
- Search existing GitHub Issues
- Open a new issue with:
- Output of
mesh-health - Output of
mesh-version - Router model and OpenWrt version
- Output of