# /etc/config/network - for wired interfaces
config device
        option name 'lan1'
        option macaddr 'random'
config device
        option name 'lan2'
        option macaddr '00:11:22:33:44:55'
config device
        option name 'lan3'
        option macaddr 'random'
# warning - some ISPs don't allow random MAC addresses,
# in this case, it's better to use any non-default address
config device
        option name 'wan'
        option macaddr 'random'
# /etc/config/wireless - for wireless interfaces
# add the last line to the end of the target wifi-device section
config  wifi-device      'wl0'
        option  type    'broadcom'
        ...
        option  macaddr 'random'

# Install the required package
apk add wireguard-tools
# Use environment variables to save connection parameters
# These can be obtained from a VNP provider's website or from a configuration file
# The port 51820 is default, VPN_ADDR6 can be skipped if there's no IPv6 endpoint
VPN_IF="wg";  VPN_SERV="SERVER_ADDRESS";  VPN_PORT="51820";
VPN_ADDR="192.168.9.2/24";  VPN_ADDR6="fd00:9::2/64"
# Enter the keys - private, pre-shared (if available), public
# or use  cat command if the keys are located in files
VPN_KEY="paste the key here"
VPN_PSK="$(cat wgclient.psk)"
VPN_PUB="$(cat wgserver.pub)"
# Firewall setup - add wg interface to WAN zone
uci rename firewall.@zone[0]="lan"
uci rename firewall.@zone[1]="wan"
uci del_list firewall.wan.network="${VPN_IF}"
uci add_list firewall.wan.network="${VPN_IF}"
uci commit firewall && service firewall restart
# Network interface setup
uci -q delete network.${VPN_IF}
uci set network.${VPN_IF}="interface"
uci set network.${VPN_IF}.proto="wireguard"
uci set network.${VPN_IF}.private_key="${VPN_KEY}"
uci add_list network.${VPN_IF}.addresses="${VPN_ADDR}"
uci add_list network.${VPN_IF}.addresses="${VPN_ADDR6}"
# Add Wireguard peers
uci -q delete network.wgserver
uci set network.wgserver="wireguard_${VPN_IF}"
uci set network.wgserver.public_key="${VPN_PUB}"
uci set network.wgserver.preshared_key="${VPN_PSK}"
uci set network.wgserver.endpoint_host="${VPN_SERV}"
uci set network.wgserver.endpoint_port="${VPN_PORT}"
uci set network.wgserver.persistent_keepalive="25"
uci set network.wgserver.route_allowed_ips="1"
uci add_list network.wgserver.allowed_ips="0.0.0.0/0"
uci add_list network.wgserver.allowed_ips="::/0"
# Verify and activate the Wireguard connection
uci commit network && service network restart
# Make sure the routing is correct:
traceroute openwrt.org