Wireguard Road warrior setup in OPNsense
WireGuard is a simple, fast VPN protocol using modern cryptography. It aims to be faster and less complex.
It is also a considerably more performant alternative to OpenVPN.
Configure the local peer (server)
-
Go to VPN > Wireguard > Local. Click + to add a new local configuration.
-
Configure the local configuration as follows:
| Parameter | Value |
|---|---|
| Enabled | checked |
| Name | call it whatever you want eg. HomeWG |
| Public key | Leave it blank |
| Private key | Leave it blank |
| Listen port | 51820 or higher |
| Tunnel address | for example, 10.0.0.1/24 |
| Peers | Leave it blank initially |
| Disable routes | Unchecked |
Configure the endpoint (client peer)
- Let’s create the keys in the client. In this case a Linux system.
$ umask 077
$ wg genkey > private.key
$ wg pubkey < private.key > public.key
$ wg genpsk > preshared.key
-
Go to VPN > Wireguard > Endpoints. And click + to add a new endpoint
-
Configure the endpoint as follows (if an option is not listed here, leave it as default):
| Parameter | Value |
|---|---|
| Enabled | Checked |
| Name | Call it whatever you want (eg. laptop) |
| Public key | Insert here the public key from the client |
| Shared secret | Insert here the preshared key |
| Allowed IPs | Unique tunnel IP address of client - it should be a /32 within the subnet configured on the local peer. For example 10.0.0.2/32 |
-
Save the endpoint configuration and click in Apply. In case the configuration is not refreshed, restart the Wireguard service.
-
Now go back to VPN > Wireguard > Local and open the local configuration.
-
In the peers dropdown select the newly created endpoint (laptop) and save the local configuration. Click in Apply again.
Assignment and routing
Assign an interface
- Go to Interfaces > Assignments and in the dropdown next to “New interface” select the wireguard device, wg0 (in case this is the first one).
- Add a description (eg HomeWG), click + to add it and then click save.
- Go to Services > DHCPv4 > [VLAN interface name]
- Click the “Enable DHCP server on [VLAN interface name] interface” checkbox
- Now enter the IP addresses range which will be used for clients in the VLAN. For example: 192.168.10.100 - 192.168.10.200
- There is no need to change any other settings unless a different gateway or DNS server are intended to be used
- Save and apply the changes
Add the appropriate firewall rules
Now that you have created and enabled a new VLAN, you will need to set up firewall rules in order for data to flow out of your VLAN. By default, all network traffic for a newly created interface is blocked so you will need to create a few rules to allow the desired traffic on that particular network. To get up and running quickly, you may clone the same basic rules that were created when the LAN interface was initially generated during the OPNsense install. There are 3 rules: the anti-lockout rule which cannot be removed (it keeps you from locking yourself out of the web administration pages), an allow all IPv4 rule.You may clone both of those rules if you wish by clicking on the far right icon beside the rule:
And then, modify the fields accordingly:
