Set interfaces wireguard wg101 peer mullvad persistent-keepalive '10' Set interfaces wireguard wg101 peer mullvad allowed-ips '0.0.0.0/0' Set interfaces wireguard wg101 peer mullvad address 'xx.xx.xx.xx' #Endpoint Set interfaces wireguard wg101 firewall local name 'WAN_LOCAL' Set interfaces wireguard wg101 firewall in name 'WAN_IN' Set interfaces wireguard wg101 description 'Mullvad fi1-wireguard' set interfaces wireguard wg101 address 'xx.xx.xx.xx/32' #Address I repeated this 4 times creating wg101-104 with different connection details per link. Next we program VyOS with the wireguard configuration for that country. Then use the same page to generate a wg-wquick configuration using that same key for a country of your choice. Upload the public key to mullvad by registering the private key via their wireguard configurator found here.

$ show wireguard keypairs privkey fi1-wireguard $ generate wireguard named-keypairs fi1-wireguard I ended up with 4 keypairs, as I wanted 4 wireguard tunnels (each to a different country). WireGuard connectionsįirst we need to generate a named wireguard keypair per tunnel.

One issue I had with this image is that I can no longer configure smp_affinity which I am still resolving. There may be some issues with earlier images not accepting interface routes, so I can't vouch for other versions. Im currently on the latest rolling release which is 1.4-rolling-202101300218.

While I have chosen mullvad, this could be done using any other provider as well. This guide assumes that you are familiar with doing configuration changes in VyOS. Currently i am able to saturate my 300mbit link using a single tunnel. In the end I ended up going for Mullvad, mostly due to their standardized WireGuard setup, and its been going great.

I found some projects that attemt to reverse engineer the protocol such as, and PIA themselves later released their own scripts for manual connections. Although PIA says they support WireGuard, their implementation is non-standard and confusing.

Mullvad wireguard setup