TH100/TH200 with VPN using Wireguard

Your TH100/TH200 STBs needs to run firmware version 286 or later.

On the server side you need a Linux box with Wireguard installed. For Debian/Ubuntu simply run:

$ sudo apt install wireguard
$ sudo sysctl -w net.ipv4.ip_forward=1

To start the server use:

sudo wg-quick up wg0

and bring it down with:

sudo wg-quick down wg0

In order to create the config files use the following script:

Save all TH100/TH200 MAC addresses into a file (e.g. macs.txt):

$ cat macs.txt
d0:9f:d9:a0:20:a6
d0:9f:d9:a0:20:a7
d0:9f:d9:a0:20:a8
d0:9f:d9:a0:20:a9

Let’s say that the public IP of your Wireguard server is 163.172.161.0.

Please note that you must use an IP address for the server, hostnames don’t work.

Run the script like this:

$ ./th100-wg.py macs.txt 163.172.161.0:51820
Server config saved to wg0.conf
TH100 config saved to th100.ini

The generated file wg0.conf must be in /etc/wireguard/wg0.conf

Configure the TH100/TH200 STBs

Put the generated th100.ini file on a flash drive and then boot each TH100 with it. When booted, it should connect to your VPN and route all traffic through it.