How to setup AmneziaWG on Keenetic

This guide was created by a community member and reviewed by us. Firmware and router interfaces may change over time, so some steps may differ depending on your device or version.

We have alternative guide for AmneziaWG that works through AWG Manager.

Prerequisites

Firmware version at least 4.2 — where first support was added for AmneziaWG 1.0, however it would require manual configuration.
Version 5.1 — latest one has support for automatic configuration.

Steps

Open Xeovo Dashboard — WireGuard section
Select Generate New Key, optionally select country.
Click on advanced settings and select protocol AmneziaWG.
Save & Download files.
Open your router interface http://192.168.1.1/
Navigate to Management > System Settings.
Check your firmware version, update if version is outdated.
Click on Component options button and search for Wireguard VPN component — it needs to be installed.
- If you install a component, you will need to reboot router.
Navigate to Internet > Other connections.
In the WireGuard section click on Import from a file button and select the config you downloaded earlier, xeovo-awg-**.conf
Click on the Edit button to the right of the new config and in popup select option ✅ Use for accessing the Internet, save.
- For now do not enable new connection, because we need to setup Policies first.
Navigate to Internet > Connection Policies.
Click on ➕ Add Policy button and enter a name like VPN. Save.
Click on that new VPN policy and check ✅ xeovo-awg-** connection, then sort it on top of the ISP connection.
- Note: Connections on a specific policy work from top to bottom for all selected connections.
- If you want to have a fallback to your ISP connection if your connection to VPN is disconnected, you would want to have both VPN and ISP connections checked ✅.
- However if you want to have a killswitch behavior then unselect ISP checkbox and keep only VPN checked ✅.
- You could create multiple policies with one of them having fallback and other working as a killswitch.
- Optionally: Sort connections in Default policy as it will affect in which order you will see them on the main page later. This is useful for multiple WireGuard connections.
Next switch to Policy Bindings tab on the same page.
Find all of your devices that need to use VPN and drag-and-drop them to corresponding policy.
- By default all of your devices in Default policy or Segment default policy
Navigate to Status > System Dashboard.
Enable your VPN connection here, xeovo-awg-**, you should see green • CONNECTED text on success.
Verify your VPN connection on https://doesmyvpn.work/

Extra steps for older, manual firmware

If you use Firmware below 5.1 you need to take extra steps. But make sure that your VPN connection is disabled, before continuing with extra steps.

First on top right click gear icon ⚙️
On sidebar click Command line
In the Command input field enter: show interface
You will see a lot of text, but you need to find your WireGuard connection here, using browser search (Ctrl+F) is useful here, you will need to see something like that:
```
"Wireguard0": {
	"id": "Wireguard0",
	"index": 0,
	"interface-name": "Wireguard0",
	"type": "Wireguard",
	"description": "xeovo-awg-no",
...
```
We would need interface-name from here.

Next open your configuration file xeovo-awg-**.conf in Notepad, you would see something like:

[Interface]
Address = ***.***.***.***
PrivateKey = ********************************************
DNS = 10.0.0.20
Jc = 5
Jmin = 42
Jmax = 54
S1 = 0
S2 = 0
H1 = 1
H2 = 2
H3 = 3
H4 = 4

[Peer]
PublicKey = ********************************************
AllowedIPs = 0.0.0.0/0
Endpoint = **.**.xeovo.com:*****

You would need to copy parameters from interface for next command

Enter command and replace those parameters from your file (For AmneziaWG 1.0 and 1.5 it is):
```
interface {name} wireguard asc {jc} {jmin} {jmax} {s1} {s2} {h1} {h2} {h3} {h4}
```

So, an example for 1.0 would look like:

interface Wireguard0 wireguard asc 5 42 54 0 0 1 2 3 4

You should see a successful message if you enter command properly.

After that you could start your VPN connection. Verify connection via DoesMyVPN.work