WireGuard is an excellent VPN protocol to run on a WiFi router due to its high efficiency and speed, often delivering up to ten times the performance of traditional VPN protocols like OpenVPN. However, many users face challenges when setting up a VPN WiFi network, as running it on a single router may not provide adequate coverage, leading to dead spots.
If you have multiple OpenWRT-capable routers, you can extend your main VPN WiFi router running WireGuard using a mesh WiFi network with Batman-adv. This setup enables a hybrid mesh network that seamlessly integrates with your local network while maintaining a secure WireGuard VPN tunnel.
Benefits of WireGuard Mesh WiFi
📡 Eliminate Dead Spots
Improve VPN WiFi coverage throughout your home or office with multiple mesh nodes.
⚡ Fast VPN Speeds
Ensure optimal performance for IoT devices, security cameras, and streaming devices.
🔗 Unlimited Connections
Connect unlimited devices to a residential IP VPN through the mesh network.
🖥️ Wired & Wireless
Provide both WiFi and wired VPN access via mesh node LAN ports.
How the WireGuard Mesh Works
A central OpenWRT router serves as both the WireGuard VPN server and mesh controller, acting as the primary DHCP server. Mesh nodes route WiFi traffic through the most efficient path back to the main VPN router, ensuring optimal performance.
To set up this system, you will need multiple OpenWRT-compatible routers with WiFi radios that support mesh networking.
Prerequisites
- ✓ Multiple OpenWRT-compatible routers (minimum 2) with mesh-capable WiFi radios
- ✓ Active TorGuard VPN subscription with WireGuard access
- ✓ OpenWRT firmware installed on all routers
- ✓ Basic knowledge of OpenWRT configuration
TorGuard Apps for Easy Setup
For WireGuard, you can use TorGuard's custom configuration generator or the built-in OpenWRT app to select any server on the network. Additionally, the TorGuard Mesh app simplifies running WireGuard over a WiFi mesh network.
Recommended: Using TorGuard's OpenWRT LuCI apps saves time and reduces errors when deploying across multiple devices.
Setting Up a WireGuard Mesh WiFi Network
Step 1: Configure the Mesh Server
- 1. Disable/Delete any active wireless networks in OpenWRT: Go to Network → Wireless
- 2. Navigate to Network → EasyMesh
- 3. Select "Server" for Mesh Mode
- 4. Enter your WiFi SSID (this is the main network that all devices will connect to)
- 5. Choose the WiFi radio for the regular AP
- 6. Select the Mesh Radio and enter a separate SSID
Tip: Use a different radio for the mesh backhaul for better performance. The EasyMesh app will automatically append "-mesh" to the SSID.
- 7. Enable Password Protection, enter a Mesh Password, and click Save & Apply
- 8. Click "Reapply EasyMesh Settings" to deploy the APs and activate mesh networking
🔹 Verification Steps:
Go to Network → Wireless and confirm the WiFi networks were added:
Navigate to Network → Interfaces and verify that the Batman (bat0) device and mesh_batman interface were created:
Step 2: Set Up a Mesh Node
- 1. On the second router, go to Network → EasyMesh
- 2. Select "Client" for Mesh Mode
- 3. Enter the same WiFi SSID, Mesh SSID, and Password as the Mesh Server
- 4. Ensure you choose the same WiFi radio type (AX, AC, b/g/n) for both SSIDs
- 5. Click Save & Apply, then click "Reapply EasyMesh Settings"
- 6. In the AP Mode tab, set a hostname (e.g., node2, node3, etc.)
- 7. Choose DHCP (recommended for Dumb AP nodes) or configure a Static IP
- 8. Click Save & Apply, then Enable Dumb AP Mode
Step 3: Add Additional Mesh Nodes
Important: For all additional nodes:
- • Use the same WiFi SSID, Mesh SSID, and Password for all nodes
- • Ensure that all nodes use the same WiFi radio type (AX, AC, b/g/n)
- • Configure unique hostnames for each node
Step 4: Verify Mesh Node Connectivity
- 1. On the Mesh Server, navigate to Network → EasyMesh
- 2. Check that all nearby nodes are listed under Mesh Status
Go to Network → Wireless and confirm that Mesh Backhaul Networks are communicating:
Find Mesh Node IPs under Status → Overview → DHCP Devices:
Test connectivity by entering a node's IP in a web browser.
Step 5: Enable TorGuard WireGuard VPN
- 1. Go to Network → TorGuard WireGuard
- 2. Enter your WireGuard Username & Password
- 3. Select your preferred WireGuard server location
- 4. Enable WireGuard and click Save & Apply
- 5. Click "Start WireGuard" to tunnel all mesh network traffic through the VPN
Success! All devices connected to your mesh WiFi network are now protected by WireGuard VPN.
Troubleshooting Tips
Mesh nodes not connecting?
Ensure all routers use the same WiFi radio type and channel width. Check that passwords match exactly on all devices.
Poor mesh performance?
Use different radios for client connections and mesh backhaul. Place nodes within good signal range of each other.
WireGuard not starting?
Verify your TorGuard credentials are correct. Check that the WireGuard package is installed on the mesh server.
Devices can't access internet?
Ensure the mesh server has internet connectivity. Check firewall rules aren't blocking mesh traffic.
Conclusion
By integrating WireGuard with a mesh WiFi network, you gain seamless VPN connectivity across multiple routers without sacrificing speed. This setup ensures secure, high-performance internet access for IoT devices, homelabs, and any number of connected devices.
With TorGuard's OpenWRT apps, setting up and managing your WireGuard Mesh WiFi network is easier than ever. If you need a dedicated IP VPN with unlimited device connections, TorGuard is the best choice for privacy and security.