Is it possible to use WireGuard on jailbroken Kindle?

[flip-rossi]

I've migrated my home server to have all services within a WireGuard VPN, but this means I can't access them anymore on my jailbroken Kindle 10th gen with KOReader (e.g. Calibre OPDS, Nextcloud WebDAV storage, Readeck w/ plugin).

Is there any way to use WireGuard on the Kindle, possibly through KOReader or KUAL? I haven't found anything on this topic, so I thought I might try asking here before giving up.

[Quoth]

VPN should only apply to connections from (or to a VPN server elsewhere) the internet, not inside your LAN.

[flip-rossi]

I can allow access within the LAN, but it's not enough. I'm not at home most of the times

[Quoth]

Originally Posted by flip-rossi

I can allow access within the LAN, but it's not enough. I'm not at home most of the times

You need a laptop, or maybe a suitable phone or tablet.

[flip-rossi]

Well, I want to connect to my services from Kindle. I'm already able to do that from my phone since I can simply use the WireGuard app.

Maybe if I could somehow tunnel the connection through my phone's WireGuard while the Kindle is connected to its hotspot, but I also didn't find a way to do that.

[Bertrandization]

Originally Posted by flip-rossi

Well, I want to connect to my services from Kindle. I'm already able to do that from my phone since I can simply use the WireGuard app.

Maybe if I could somehow tunnel the connection through my phone's WireGuard while the Kindle is connected to its hotspot, but I also didn't find a way to do that.

On android and koreader this is theoretically possible, but I don't know if you can make it practical and secure, let alone seamless, particularly if you want to use both mobile hotspot and local wifi connections:
1. Use WG Tunnel app on the android phone (FOSS app) and set up your wireguard tunnel to use http proxy.
2. On koreader go to settings->network. Make sure it's connected to your phone. I had to go out of koreader and disconnect from my local network and connect to my phone to get it to connect properly. Hold down HTTP proxy to enter the proxy address. This time it is in the format eg "http://192.168.x.y:25345", noting that the protocol is specified this time.

I'm unable to test this properly without completely revamping my setup: all the services I use (sync, wallabag, syncthing, calibre) are either reached using split-brain dns, where I know they are https or they do not use the http protocol.

Even if it did work, I more often am connected to my local network, so wouldn't want to have to mess around turning all this on and off. It's also only http and not SOCKS5, so calibre and syncthing won't ever work this way, even if I set up an otherwise pointless http proxy locally to overcome the switching problem, and reconfigured my dns, etc.

Ideally, there would be a wireguard interface in koreader. That way it won't matter what it's connected to and you don't need proxy servers at all. I'm not sure how much work is involved in setting that up. My oasis 10th gen says uname -r: 4.1.15-lab126 and wireguard was not built into the kernel until 5.6, so there might be a fair bit of work.

[Bertrandization]

UPDATE: Solved, for android.

Gist:
1. root phone.
2. install magisk.
3. install temefi, give it root powers.
4. install wg tunnel. set up wireguard normally.
5. install vpn hotspot. give it root.
6. use temefi to make vpn hotspot a system app.
7. set up vpn hotspot to route your traffic through wireguard.

koreader now works perfectly with locally hosted syncthing, progress sync, wallabag, etc.

Phones are all trash in 2025: spyware-infested, crippled, absolute contempt for the user. Samsung has the temerity to yell at me in red text that I am insecure because I rooted "their" phone and managed to remove most of their and google's spyware off it. Why am I insecure? Because they now refuse to provide security updates, like some toddler having a tantrum, unless I reinstall their spyware and revert the phone to its manufacturer provided broken state where you cannot accomplish even basic networking tasks.

[Quoth]

Trivial for a phone or tablet as Kindle is only an app. Hardly likely on an eink Kindle.

[flip-rossi]

@Bertrandization Thank you for sharing your solution!

I use GrapheneOS which doesn't support rooting (or at least not in a way that preserves many of its security guarantees), so I'm not very inclined in taking this route. Still, I hope this helps someone with similar requirements.