Download AmneziaWG Packages: On your computer, download the following AmneziaWG packages from the Amnezia GL.iNet MT-3000 releases page for firmware version 4.6.6:
kmod-amneziawg_4.6.6.ipk
amneziawg-tools_4.6.6.ipk
luci-proto-amneziawg_4.6.6.ipk
Install Packages:
In LuCI, navigate to System -> Software.
Click on the Upload Package... button.
Upload and install each of the three downloaded .ipk files one by one (in order as mentioned above).
On the next screen, you will be on the Interface: AWG settings page.
Look for an option to "Import configuration"
You may need manually define some params
Step 5: Create Firewall Rule
Configure Firewall Zone:
While still on the Interface: AWG settings page, go to the Firewall Settings tab.
Create a new firewall zone for the AWG interface. You can name it awg_zone.
Set the Input, Output, and Forward policies to accept.
Under Covered networks, ensure that AWG is selected.
Under Allow forward to destination zones, select wan.
Under Allow forward from source zones, select lan.
Click Save.
Step 6: Enable "Route Allowed IPs"
This is a crucial step that was not explicitly clear in the original instructions but was necessary for your setup.
Go to Interface Settings: Navigate back to Network -> Interfaces.
Edit AWG Interface: Click on Edit next to your AWG interface.
Go to Peer Settings: Navigate to the Peers tab within the AWG interface configuration.
Check "Route Allowed IPs": Locate the specific peer configuration (the one corresponding to your AmneziaWG server). Check the box next to "Route Allowed IPs."
Save & Apply: Click Save at the bottom of the page, and then click Save & Apply to apply all changes.
Step 7: Verify Connection
Interface Status: Go to Network -> Interfaces. Your AWG interface should now show as "Up" or "Connected" if the configuration is correct.
Test Connectivity:
Connect a device (e.g., your computer or phone) to your GL.iNet MT-3000's Wi-Fi or LAN.
Verify your public IP address using a website like whatismyip.com. It should now reflect the IP address of your AmneziaWG server.
I would get a device that supports native openwrt firmware. But it may be possible to install the package if the Target Platform is supported. You can attempt to compile your own packages using the github action.
In my case for AXT1800 is running on openwrt 21.02 and I believe the minimum openwrt version required is 23.05
We are currently working hard for v4.8.0 firmware.
The v4.9.0 is under pre-research, but the expected time is not sure.
It is after all functions are completed to pre-research, and move to develop, then we may estimate the approximate release time.
After installing the packages in step 2, I had to reboot the MT-3000 (Beryl). This step is not mentioned/missing in the guide. Otherwise, the protocol "AmneziaWG VPN" was not selectable / did not appear in the dropdown list for Step 4.1 "Create new interface".
In step 5, I was able to manually enter a firewall zone name like "awg_zone". The web interface did mention "(create)" next to it, but did not offer to configure the zone as mentioned (e.g. for setting Input/Output/Forward to accept). So I had to manually change to Network/Firewall later and modify the corresponding entry.
Then my problem was:
The AWG connection to the peer seems to be OK and working. Checking Status/AmneziaWG I see traffic received and transmitted on the interface including last handshake timestamp. However, I couldn't manage to establish a connection from the laptop (connected via wifi to the MT-3000) to the internet via the AmneziaWG interface. I could not get it working with firmware version 4.6.6 and also not with version 4.7.5, which I tried in addition.
I want to have all LAN/wifi traffic of the MT-3000 exclusively routed via the AmneziaWG interface, without having any traffic bypassing the VPN (for usage in a restricted country).
So -- while I prepared this for a post to ask how to set it up, I managed to configure it (hopefully properly). Please find here some screenshots of the required firewall configuration (based on version 4.7.5):
But the main thing why it didn't work before was missing default route via awg interface
Don't forget to switch it on NETWORK-->INTERFACES-->AWG interface-->peers-->Route Allowed IPs
apply and restart the interface
@bruce Please, use specifically the latest AmneziaWG 1.5 version, as there were vulnerabilities in the 1.0 which made it susceptible to blocking. This is extremely important, as 1.0 is going to be useless very soon and is already being blocked in a lot of places.
