Keenetic WireGuard Toolkit

This bundle contains two scripts:

1. keenetic-wg-auto-tune.sh — Safe MTU/MSS tuner for a Keenetic WireGuard interface via RCI.

   • Read‑only by default (DRY).
   • Binds tests to your local WG (so traffic really goes through Keenetic).
   • Handshake gate before writing (unless --force).
   • Changes only mtu and adjust-mss on the router.

2. wg-make-peers.sh — Peer factory for client configs (+ optional PSK), router-side hints and optional QR.

Requirements

macOS:

brew install wireguard-tools jq qrencode

Linux (Debian/Ubuntu):

sudo apt-get install wireguard-tools jq qrencode curl

Quick start — tuner (dry run)

sudo ./keenetic-wg-auto-tune.sh   -r https://ROUTER_HOST -U RCI_USER -I Wireguard0   -m 1400,1388,1384,1380,1376,1372,1368,1364,1360   -s on,off   -t "https://duckduckgo.com,https://github.com,https://yandex.ru,https://cloudflare.com/cdn-cgi/trace"   -D "https://speed.cloudflare.com/__down?bytes=10485760"   -C /etc/wireguard/wg0.conf   --autostart-client --debug

Apply a chosen combo

sudo ./keenetic-wg-auto-tune.sh   -r https://ROUTER_HOST -U RCI_USER -I Wireguard0   -m 1380 -s on   -t "https://duckduckgo.com,https://github.com"   -D "https://speed.cloudflare.com/__down?bytes=10485760"   -C /etc/wireguard/wg0.conf   --autostart-client --write --apply

Outputs

• keenetic-wg-results.csv: router_if,mtu,mss,ok_http,total_http,median_connect_ms,throughput_kbps
• keenetic-wg-per-site.csv: per-URL timings (if enabled)

Safety

• The tuner refuses to write without a WG handshake unless --force.
• It never touches peers/keys.

Peer generator

Generate two named peers:

./wg-make-peers.sh --names "iphone,macbook"   --server-pub 'ROUTER_PUBLIC_KEY=' --endpoint '178.176.40.248:51820'

Or make N peers:

./wg-make-peers.sh --count 3 --server-pub 'ROUTER_PUBLIC_KEY=' --endpoint 'host:51820'

Outputs

• <name>/<name>.conf (client config)
• <name>/<name>-router.txt (values to use in Keenetic “Add peer”)
• peers.csv (summary)
• Optional <name>.qr.txt if qrencode is installed — scan in iOS/Android WG app.

Troubleshooting

• RCI 401 → verify URL/creds; the script auto-switches http/https if needed.
• No handshake → ensure router peer public key = client public; and client [Peer] PublicKey = router interface public key; UDP port reachable; Allowed v4 IPs on router matches client /32.
• On macOS, wg0 maps to utunX: sudo wg show utun6.

License

MIT – no warranty.