Your own VPN home with WireGuard: reach cameras, NAS and smart home from outside
When you need to reach cameras, a NAS or Home Assistant away from home, the worst thing you can do is expose them straight to the internet. The right way is your own VPN, and WireGuard is simpler to set up than it seems.
What it is for
A home VPN creates a protected tunnel from your phone or laptop to your home network. You connect and see everything as if you were at home: cameras, NAS, printer, smart home dashboard. Only one VPN port is open to the outside, not ten services with weak passwords. It is not a tool for bypassing blocks and not a “change country” service: it leads only to your home network.
What you need
- A router with WireGuard support: MikroTik with RouterOS 7, Keenetic, OpenWrt, UniFi (Gateway), some models from other makers. If your router lacks it, WireGuard can run on a small home server (Raspberry Pi) or a NAS.
- An external (public) IP address. Without it the VPN cannot connect from outside.
- Preferably a static address or DDNS: a service that ties a permanent name to a changing address.
- The WireGuard client app on a phone or computer (available for all systems, free).
First check whether you have a “white” address
Many providers give one address to several subscribers (CGNAT). Then you cannot connect from outside. Look at the WAN address your router shows and compare it with what a “what is my IP” site shows. If they differ, or the address starts with 100.64 to 100.127, you are behind CGNAT. Often the provider offers a public address as an extra service. There are workarounds (a remote relay server or services like Tailscale) but they are separate from this guide.
Step 1. A WireGuard interface on the router
- Create a new WireGuard interface. The router will generate a private and a public key: show the private one to nobody.
- Set a VPN network address that does not clash with your home network. For example, the home network is 192.168.1.0/24 and the VPN is 10.10.10.0/24 with the router at 10.10.10.1.
- Port: UDP 51820 is standard. You may choose another, which cuts down “noise” from scanners a little.
Step 2. Allow the port in the firewall
Add a firewall rule that lets inbound UDP to the WireGuard port in from the internet (WAN). Do not open anything else. For clients connected through the VPN, allow access to the home network.
Step 3. Add a device (peer)
- On the phone open WireGuard and create a new tunnel with key generation. It will show a public key.
- On the router add a peer: paste the phone's public key and give it an address from the VPN network, for example 10.10.10.2/32.
- In the phone set: address 10.10.10.2/32, DNS (for example the router address), and in the peer section: the router's public key, endpoint (your external address or DDNS name and the port) and “Allowed IPs”.
“Allowed IPs” decides what goes through the tunnel. For home-only access list the home network and the VPN network, for example 192.168.1.0/24, 10.10.10.0/24. The rest of the internet then goes directly as usual. If you want all traffic to go through home (for example on someone else's Wi-Fi), use 0.0.0.0/0.
Many routers can show the client configuration as a QR code. That is the quickest way to set up a phone: scan and done.
Step 4. Test
- Turn off Wi-Fi on the phone and use mobile data.
- Turn on the WireGuard tunnel: it should show an active connection and the data counter should grow.
- Open the address of a home device, for example the router page or Home Assistant at its internal address. If it opens, everything works.
Security
- A separate peer (separate keys) for each device. Lost a phone: delete its peer and the rest keep working.
- Never send or photograph the private key.
- Keep the router firmware up to date: flaws are found in VPN implementations too.
- Open nothing else on the router to the internet besides the WireGuard UDP port.
- Limit what is reachable through the VPN if the router allows it (for example only the needed addresses).
Typical mistakes
- Networks clash: 192.168.1.0/24 at home and the same in a hotel or office. Addresses get mixed up. An unusual home subnet such as 192.168.77.0/24 helps.
- No “white” address: you cannot connect from outside.
- Forgot to allow the port in the firewall or ran into a second firewall (on the provider's modem).
- Did not add the home network to the route or “Allowed IPs”.
- MTU too high: the tunnel connects but pages load with difficulty. Try MTU 1380 to 1420.
Need help with this?
Describe the task and we will suggest where to start. The first conversation is free.