WireGuard VPN

Before you start

• Check that the scooter has internet access through its SIM card.
• Choose a WireGuard server you control, such as a VPS or your home router. Its UDP endpoint must be reachable from the internet.
• Choose an unused tunnel address for the scooter. The examples use 10.77.0.1 for the server and 10.77.0.2 for the scooter.

On a computer with the WireGuard tools, generate a key pair with:

umask 077
wg genkey | tee scooter-private.key | wg pubkey > scooter-public.key

Use one key pair per device. Put the contents of scooter-private.key in the scooter configuration and scooter-public.key in its peer entry on the server. For a new server, generate another pair using the same command with server-private.key and server-public.key as the filenames. If you already have a client configuration for the scooter, you can use its keys and assigned address.

Scooter configuration

Create a plain-text file named wg-scooter.conf. Use the standard WireGuard INI format, with an [Interface] section for the scooter and a [Peer] section for the VPN server. Replace every placeholder and adapt the example addresses to your VPN:

[Interface]
PrivateKey = <SCOOTER_PRIVATE_KEY>
Address = 10.77.0.2/32

[Peer]
PublicKey = <SERVER_PUBLIC_KEY>
Endpoint = vpn.example.net:51820
AllowedIPs = 10.77.0.0/24
PersistentKeepalive = 25

If the server uses a preshared key, add PresharedKey = <SHARED_KEY> to [Peer] on the scooter and configure the same value for this peer on the server. DNS and MTU are optional; add them only if your VPN setup requires them.

Save each tunnel directly in wireguard/ with a lowercase .conf extension. The filename stem becomes its NetworkManager connection/interface name: use at most 15 letters, digits, hyphens or underscores, such as wg-scooter.

NetworkManager imports the scooter profile. Keep it to interface and peer settings; omit wg-quick options such as PostUp, PostDown and SaveConfig.

For remote access, AllowedIPs only needs the VPN subnet. Use 0.0.0.0/0 or ::/0 if you also want to route internet traffic through the server. Choose a VPN subnet that does not overlap the scooter's internal networks, including 192.168.7.0/24 and 192.168.8.0/24.

Configure the server

For an existing VPN, add the [Peer] section below to your server configuration, using the scooter's public key and chosen address. For a new VPN, this is a minimal server profile matching the scooter example:

[Interface]
PrivateKey = <SERVER_PRIVATE_KEY>
Address = 10.77.0.1/24
ListenPort = 51820

[Peer]
PublicKey = <SCOOTER_PUBLIC_KEY>
AllowedIPs = 10.77.0.2/32

Load the profile using your server's WireGuard tools and allow UDP port 51820 through its firewall. For a server behind your home router, forward that UDP port to the server. Set the scooter's Endpoint to the server's public hostname or IP and port.

To connect from a laptop or phone, add that device as another VPN peer. Enable IP forwarding on the server and allow forwarding between the VPN peers in its firewall. Include 10.77.0.2/32 in that client's AllowedIPs so it routes scooter traffic through the VPN.

Install with Update Mode

1. Enter Update Mode and connect the USB drive to your computer.
2. Open wireguard/ at the root of the drive. Existing scooter configurations are exported here; keep any tunnels you still want.
3. Copy wg-scooter.conf into that folder, or edit an existing .conf file in place.
4. Safely eject the drive and leave Update Mode. UMS copies the files to /data/wireguard/ on the MDB and restarts librescoot-settings when the configuration changes.
5. Settings-service imports the profiles into NetworkManager and enables automatic connection. No scooter reboot is needed.

The exported files contain private keys. Store backups securely and do not attach these files to public support reports.

Install over SSH instead

If you already have SSH access to the MDB, copy the same file directly. Replace MDB_ADDRESS with its reachable address; do not interrupt a tunnel that is your only connection:

ssh root@MDB_ADDRESS 'mkdir -p /data/wireguard'
scp wg-scooter.conf root@MDB_ADDRESS:/data/wireguard/wg-scooter.conf
ssh root@MDB_ADDRESS 'chmod 600 /data/wireguard/wg-scooter.conf && systemctl restart librescoot-settings'

To remove a tunnel over SSH, delete its /data/wireguard/*.conf file and restart librescoot-settings. The service updates the accompanying .sha256 files automatically.

Check the connection

On the MDB, inspect import errors, the active profile, and the last handshake:

journalctl -u librescoot-settings -b --no-pager
nmcli connection show --active
wg show

From a computer on the VPN, try ssh root@10.77.0.2 using your configured scooter SSH credentials. This connects to the MDB at its VPN address.

• If import fails, check the exact filename, section names, base64 keys and address prefixes. UMS copies the file; NetworkManager parses the WireGuard configuration.
• If the interface is up but there is no handshake after sending traffic, check mobile connectivity, endpoint DNS/UDP reachability, both public keys, and any preshared key.
• If a handshake succeeds but SSH fails, check the address, AllowedIPs on both sides, forwarding/firewall rules and SSH credentials.
• A suspended scooter is not continuously reachable. A keepalive does not keep the scooter awake or wake it from hibernation.

Protocol background: WireGuard Quick Start.