---
title: "Setting Up a WireGuard Connection (Initiator, Client)"
slug: "setting-up-a-wireguard-connection-initiator"
updated: 2026-08-06T14:02:43Z
published: 2026-08-06T14:02:43Z
canonical: "docs.insys-icom.com/setting-up-a-wireguard-connection-initiator"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.insys-icom.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting Up a WireGuard Connection (Initiator, Client)

This configuration guide shows you how to configure a [WireGuard connection](/kb/docs/vpn-and-ppp-connections-en#wireguard) to a remote peer established by the router.

## Situation

An encrypted WireGuard connection is to be established to a subnet behind a remote peer (remote station) that is connected to the Internet. The parameters required for the connection are defined by a WireGuard configuration file. The router shall establish a connection to the remote peer, i.e. it should not act as the responder, but as the initiator. The public key of the remote station is known. The remote peer can be reached via a public IP address or domain on the internet.

> [!NOTE]
> Router as Responder!
> 
> See this [Configuration Guide](/kb/docs/setting-up-a-wireguard-connection-responder) for a WireGuard connection with the router acting as Responder.

## Solution

It is assumed that you have access to the router's user interface and that the router has been configured for a WAN connection using the [Startup Wizard](/kb/docs/quickstart-wizard-en) from the basic settings. The following figure shows the network topology used for this example:

![](https://cdn.document360.io/c690fe99-a3eb-474c-a449-c2c75e5df119/Images/Documentation/image(541).png)

> [!NOTE]
> Please note for the addresses used!
> 
> All addresses are exemplary for the present example and must be adjusted to your application.

### Configuration of the router

For a WireGuard connection, you must first configure your own endpoint and then the remote stations (peers) to which connections are to be established.

> [!NOTE]
> Please note for possible differences in the naming of the cellular interface!
> 
> The cellular interfaces have been renamed from `lteX` to `cellularX` with version **icom OS 10.0**. Depending on the version, the following description may therefore differ from your router. For security reasons, we recommend that [you regularly update your router](/kb/docs/updating-a-router-manually-en) to the latest version anyway. See [FAQ](/kb/docs/how-does-the-renaming-of-the-cellular-interface-from-ltex-to-cellularx-affect-my) for more information.

1. Open the user interface of the router: [https://insys.icom](https://insys.icom)
2. Add a new WireGuard interface. Click on the *Network* → *Interfaces* page under *WireGuard* on and configure as follows:

  - *Description*: Local WireGuard Peer
  - *Priva**te key*: click on Generate new key pair; a new key pair is generated and entered

> [!NOTE]
> Please note the following regarding the keys!
> 
> A key pair consists of a private key and an associated public key. The public key must be communicated to the peer (remote station) of the WireGuard connection. The peer uses this public key to mark the WireGuard packets that are addressed to the router.
  - *Local tunnel address / Netmask*: 10.0.0.1/24
  - *Accept incoming connections on port*: can be entered optionally if the router is also to be able to accept incoming connections
3. Add a new WireGuard peer- Click under *Add WireGuard* in the *Add WireGuard peers* section on and configure as follows:

  - *Description*: Remote WireGuard Peer
  - *Public key*: enter the public key of the peer here
  - *Allowed IP addresses*: 10.0.0.0/24, 192.168.200.0/24 (the address range of the tunnel IP network and the remote network)

> [!NOTE]
> Please note regarding the allowed IP addresses!
> 
> Enter all addresses in CIDR format to which this WireGuard tunnel is allowed to send data (destination IP addresses). Multiple addresses must be separated by commas. The catch-all addresses 0.0.0.0/0 for all IPv4 addresses and ::/0 for all IPv6 addresses permit all addresses via the respective protocol.
  - *Endpoint*: example.wireguard-vpn.com (reachable IP or domain address of the peer station)
  - *Port*: 51820

> [!NOTE]
> Please note regarding the port!
> 
> The port must be the same as the one entered at the peer so that the router can listen for WireGuard packets from this peer that contain its public key. 51820 is a standard port for WireGuard, but another port can also be used. If no port is specified, it will be assigned randomly and the peer will not be able to establish a WireGuard connection without knowing this port.
  - *Pre-shared key*: can be entered optionally in base64 format for an additional layer of symmetric encryption; in this case, it must also be configured at the peer end
  - *Keep-alive interval*: 30 (can be entered optionally in seconds; if the INSYS router acts as initiator, it is recommended to enable Keep-Alive so that the tunnel is established immediately after startup in the WAN chain to the endpoint, allowing reverse connections to be established from the WireGuard peer to the router or its local network; when enabled, authenticated empty packets are sent to the peer to maintain the connection for a stateful firewall or NAT mapping; if this value is empty or configured to 0 (zero), this function is disabled) ![](https://cdn.document360.io/c690fe99-a3eb-474c-a449-c2c75e5df119/Images/Documentation/image(554).png)
4. Click on SUBMIT.
5. Add a new Firewall rule that permits packets through the WireGuard tunnel to the router. Click on the *Network* → *Firewall / NAT* page under *IP filter* on and configure as follows:

  - *Description*: Traffic through the WireGuard tunnel to the router - in
  - *Packet direction*: INPUT
  - *IP version*: All
  - *Protocol*: All
  - *Incoming interface*: wg1
  - *Sender IP address / Netmask*:

> [!NOTE]
> Bitte beachten Sie für die Firewall-Regeln!
> 
> Die Regeln in diesem Beispiel erlauben mehr als nötig unter Aufrechterhaltung einer hohen Sicherheit. Sie können diese auch weiter auf für ihre Anwendung unbedingt erforderlichen Datenverkehr einschränken und damit die Sicherheit weiter erhöhen.

![](https://cdn.document360.io/c690fe99-a3eb-474c-a449-c2c75e5df119/Images/Documentation/image(414).png)
6. Click on SUBMIT.
7. Add a new Firewall rule that permits packets through the WireGuard tunnel from the router. Click on the *Network* → *Firewall / NAT* page under *IP filter* on and configure as follows:

  - *Description*: Traffic through the WireGuard tunnel sent by the router - out
  - *Packet direction*: OUTPUT
  - *IP version*: All
  - *Protocol*: All
  - *Outgoing interface*: wg1
  - *Sender IP address / Netmask*:
8. Click on SUBMIT.
9. Add a new Firewall rule that permits packets from the local network through the WireGuard tunnel. Click on the *Network* → *Firewall / NAT* page under *IP filter* on and configure as follows:

  - *Description*: Traffic from the local net through the WireGuard tunnel
  - *Packet direction*: FORWARD
  - *IP version*: All
  - *Protocol*: All
  - *Incoming interface*: net1, net2
  - *Outgoing interface*: wg1
  - *Sender IP address / Netmask*:
  - *Destination IP address / Netmask*:
10. Click on SUBMIT.
11. Add a new Firewall rule that permits packets through the WireGuard tunnel into the local network. Click on the *Network* → *Firewall / NAT* page under *IP filter* on and configure as follows:

  - *Description*: Traffic through the WireGuard tunnel to the local net
  - *Packet direction*: FORWARD
  - *IP version*: All
  - *Protocol*: All
  - *Incoming interface*: wg1
  - *Outgoing interface*: net1, net2
  - *Sender IP address / Netmask*:
  - *Destination IP address / Netmask*:
12. Click on SUBMIT.
13. Add a new Firewall rule that permits the establishment of the WireGuard tunnel. Click on the *Network* → *Firewall / NAT* page under *IP filter* on and configure as follows:

  - *Description*: WireGuard (tunnel establishment)
  - *Packet direction*: OUTPUT
  - *IP version*: All
  - *Protocol*: UDP
  - *Outgoing interface*: lte2 (or another interface that is used to establish Internet connection)
  - *Sender port*:
  - *Destination port*: 51820
14. Click on SUBMIT.
15. Click on on the *Network* → *Routing* page under *Static routes* to add a new [static route](/kb/docs/routing-en) through the WireGuard tunnel to the remote subnet behind the remote station and configure this accordingly:

  - *Description*: WireGuard route to 192.168.200.0
  - *Creation after start of Interface*: wg1
  - *Type of the route*: **Network** 192.168.200.0 / 24
  - *Gateway*: **interface** wg1 ![](https://cdn.document360.io/c690fe99-a3eb-474c-a449-c2c75e5df119/Images/Documentation/image(518).png)
16. Click on SUBMIT.
17. Add the WireGuard interface to the active WAN chain. Click on the *Network* → *WAN / Internet* page on of the WAN chain *wan1 - Primary Internet connection* to edit this.
18. Click on to and select the WireGuard interface wg1 as *Interface*. ![](https://cdn.document360.io/c690fe99-a3eb-474c-a449-c2c75e5df119/Images/Documentation/image(416).png)
19. Click on SUBMIT.
20. Activate the profile with a click on ACTIVATE PROFILE .

### Configuration of the peer

In addition to the router, the peer must also be configured so that the router can establish a connection to it. The procedure for this varies depending on the peer. The following configurations are generally required.

1. Configure in the *Interface* section:

  - the *ListenPort* that must be identical with the one of the router.
  - under *Address* the local tunnel address of the peer that just be in the same IP network as the tunnel address of the router.

1. Configure in the *Peer* section:

  - the *PublicKey* of the router.
  - under *AllowedIPs* 10.0.0.0/24, 192.168.2.0/24 (address range of the tunnel IP network and the remote network)

An example for the configuration of WireGuard on a Windows PC acting as the responder:

![](https://cdn.document360.io/c690fe99-a3eb-474c-a449-c2c75e5df119/Images/Documentation/image(551).png)

## Result testing

Once the router and peer have been configured for a shared WireGuard connection, the peer should establish a connection to the router.

1. Open the *Status* → *Dashboard* page and click in the *Network configuration* section on the WireGuard interface at the end of the WAN chain in the *VPN* column. ![](https://cdn.document360.io/c690fe99-a3eb-474c-a449-c2c75e5df119/Images/Documentation/image(417).png)

The confirmed handshake and the transferred data show that the WireGuard connection has been successfully established.

## Troubleshooting

- Disable the IP filters for IPv4 in the *Network* → *Firewall / NAT* menu under *Settings IP filter* to check whether incorrect filter settings are the reason for connection problems.
- If the WireGuard connection is established, but a communication into the network behind the router is still not possible, you can open the *Administration* → *Debugging* page and use the *Tool* TCP-Dump and enter the *Parameter* **-i net2** to perform a TCP dump in the local network of the router or enter **-i wg1** in the tunnel. The results may provide an indication of where the packets end up.
- Check whether the peer station is possibly located behind a firewall (e.g. Windows Firewall on a PC) and whether this is preventing data traffic.
- Issues caused by incorrect entries under AllowedIPs can be identified on the *Status* → *Log view* page in the WireGuard log by the message **unallowed IP**, since all IP packets from unauthorized source IP addresses (as responders) or destination IP addresses (as initiators) are immediately discarded by the WireGuard interface.
- If the connection is unstable, check the *latest handshake* entry on the *Status* → *Dashboard* page (see the screenshot under [Result testing](/kb/docs/setting-up-a-wireguard-connection-initiator#result-testing)). If this entry is older than 2 minutes, enable the *Keep-Alive* parameter for the WireGuard interface in the router and set it to less than 120 seconds.

Standard IP address: https://192.168.1.1; login depending on configuration; default for earlier firmware versions: *User name*: **insys**, *Password*: **icom**