Problem to setup WG config: GL-AR300M -> Wireguard -> FritzBox

I have trouble to setup a wireguard vpn config.

What I want to do ?
I want to use the GL Router as VPN Gateway to a FritzBox in other location. The GL-AR300M should provide a Wifi which routes all traffic to the remote Fritzbox.

Location A: GL-AR300M ( > FritzBox 7590 ( > (WAN = DSL)
Location B: FritzBox 7530 ( (WAN = Cable)

I configured the FB 7530 in Location B as Wireguard Server. Made profiles for all my devices (iPhone, iPad, Mac, Windows Device and also for GL-AR300M. All other devices a working as expected, but the GL-AR300M not.

The GL-AR300M is connected to the FB7590 via WAN Port. Internet is reachable from GL-AR300M Wifi.

Any Ideas ?

Again… all other devices are working. Is there any route was I have to add manually ?

It sounds like you’d done the only thing that should be needed: setting the Shadow (AR300M) to act as a WG client to connect out to Loc B’s WG server.

Can you post a profile/conf for a ‘known good’ WG client device & the conf used for the Shadow? I’d like to compare them. Be sure to redact where appropriate.

Can you ssh into your Shadow? I speculate but I’m wondering if this isn’t some sort of MTU issue. My Certa is near identical to a Shadow; it seems to prefer a MTU of 1320 for WG.

So after a lot of strange behavior in Webinterface I upgraded to Beta Firmware 4.3.6.

After enabling ipv6. is the tunnel is now up and the Wireguard Server is pingable. But a don’t have Internet. Google dns is not pingable.

Here my setup again:

Location A:
FB7590 routes ipv4: net subnet gw
FB7590 routes ipv6: not configured

ipv6: enabled

Client A: wants to use Internet from Location B

Location B:
Routes ipv4: not configured
Routes ipv6: not configured

VPN Tunnel is up and Client A can ping but not (should it ?)

Here is a config from a working laptop:

PrivateKey = PrivateKeyString
Address =
DNS =,

PublicKey = PublicKeyString
PresharedKey = PresharedKeyString
AllowedIPs =,,
Endpoint =
PersistentKeepalive = 25

Here from Shadow:

PrivateKey = PrivateKeyString
Address =

PublicKey = PublicKeyString
PresharedKey = PresharedKeyString
AllowedIPs =
Endpoint =
PersistentKeepalive = 25

Should I add any additional routes ?

Fritzbox implements a non standard wireguard configuration.
Google about It and you’ll see.
I’ve never been able to make my mother’s fritz connect with my openwrt or Asus routers.

Hi DocUmibozu on SmallNetBuilder! That’s a nice tip re: third party Fritzbox firmware for proper WG implementation.

I set the DNS and AllowedIP values same as working Laptop config and it’s working now.

Can anyone explain why the FritzBox creates different configs ?

I’m glad you got it sorted. I’d think that’s a question better directed to

Yes, the Freez firmware…
which is no longer mantained and deprecated

GitHub - Freetz/freetz: Freetz firmware extension/modification for the ​AVM FRITZ!Box series and devices with identical hardware

You can use Freez-NG, which seems to be supported… but is a pain in the ass, an entire recompilation of the kernel…
Why when you can buy an Opal for less than 50 euro and live happy with a standard wireguard?

There’s no luck w/ Freetz-NG? The last push I see was 2 days go.

IDK. Why do people install Windows 11 if they claim they value privacy? Maybe because they don’t know what they don’t know. < / philosophical musings >

1 Like

Seems an easy task… :rofl:

You need an up to date Linux System with some prerequisites.
Or download a ready-to-use VM like Gismotro’s Freetz-Linux (user & pass: freetz).
There are also Docker images available like pfichtner-freetz (README).
Your linux user needs to have set umask 0022 before checkout and during make.

an entire toolchain to rebuild the firmware from scratch…

Well, I guess it’s a matter of taste then; when I was rolling my own kernels I didn’t have the convenience of a VM to pull down, ready to go. Reading a HOW-TO or three is hardly a show stopper. YMMV.

Does this solution work?