WireGuard on OPNsense: How to implement VPN securely and efficiently

Why choose WireGuard on OPNsense

WireGuard is a modern VPN protocol that emphasizes simplicity and speed. When deployed on OPNsense, you gain:

• A native, well-integrated VPN option within your firewall
• Efficient performance suitable for remote work, small offices, or cloud connectivity
• An easy configuration model with keys and peers rather than certificates
• Strong cryptography and a reduced attack surface compared to older VPN tech

However, there are caveats to consider:

• WireGuard is stateless in its core design. You’ll need careful policy and key management to handle revocation and access control
• NAT traversal and firewall rules require precise setup to avoid leaks or blocked traffic
• On some hardware, CPU and memory usage should be monitored as you scale the number of peers

By weighing these factors, you can decide if WireGuard on OPNsense aligns with your goals, then proceed with a concrete plan.

Prerequisites and planning

Before you dive into the UI, gather what you need:

• OPNsense installation with access to the web GUI
• A public IP or dynamic DNS for the OPNsense box if you want remote access
• A rough idea of your VPN topology: remote users, site-to-site, or both
• A security policy: which networks should be accessible through the VPN
• Adequate resources on your device (CPU, RAM) to handle the expected number of peers

Plan your addressing and routing: WireGuard on pfSense: a practical guide to setting up and using WireGuard on pfSense

• Choose a dedicated WireGuard IP range (for example 10.0.0.0/24) for internal peer addressing
• Decide which subnets will be reachable via the VPN (e.g., 192.168.1.0/24 on the remote side)
• Determine the default route behavior for VPN traffic (split tunneling vs. full tunneling)
• Prepare to define peers with public keys and allowed IPs

If you’re new to OPNsense, take a moment to explore the VPN and firewall sections in the UI so you’re ready to configure:

• System > Trust > Authorities (if you plan to use internal CA for anything else)
• VPN > WireGuard (the central place for configuration)
• Firewall > Rules (to allow VPN traffic through interfaces)

Installing and enabling WireGuard on OPNsense

The WireGuard feature in OPNsense is available as a built-in plugin. Here’s how to enable it:

• Go to System > Firmware > Local and check for the WireGuard plugin (or use the Plugins tab in the UI).
• Install the WireGuard plugin and wait for the system to apply changes.
• After installation, you’ll see a new WireGuard section under VPN.

Once installed:

• Open VPN > WireGuard to begin configuration
• Create a new Local Instance (the OPNsense device as a WireGuard endpoint)
• Generate a private and public key pair for this local instance
• Decide on a Listen Port (default is 51820, but you can choose another if needed)
• Create peer entries for each remote device or site that will connect

Note: Keep private keys secure and back them up. If you lose a private key, you’ll need to reconfigure the associated peers.

Configuring a local WireGuard endpoint (OPNsense)

A typical local endpoint configuration includes: WireGuard on TrueNAS

• Private Key: generated for the OPNsense device
• Public Key: shared with each peer
• Listen Port: the UDP port the endpoint will listen on

Under the Local section:

• Name: something meaningful like WG-OPNsense
• Private Key: paste or store the generated key
• Listen Port: 51820 (or your chosen port)

Under the Peers section, you’ll add each remote party (user or site). For each peer:

• Public Key: the key from the remote device
• Allowed IPs: the IPs this peer will be assigned or allowed to reach (e.g., 10.0.0.2/32 for a single peer, or a set of networks if you’re using a site-to-site link)
• Endpoint Address: optional, if you know where the peer will be reached (for dynamic IPs, you’ll fill this in later)
• Persistent Keepalive: 25-60 seconds (helps keep NAT mappings alive in some setups)

If you are building a site-to-site VPN, use the Allowed IPs to specify the remote LANs (e.g., 192.168.2.0/24 on the other site).

Firewall rules and NAT considerations

VPN traffic must be allowed by the firewall. You’ll need to configure rules on the WireGuard interface, and potentially on the WAN and LAN interfaces to permit traffic:

• On the WireGuard interface (the one created for your local endpoint), allow inbound UDP traffic on the chosen Listen Port
• Allow traffic from the VPN networks to the relevant internal networks (e.g., 10.0.0.0/24 to 192.168.1.0/24)
• If you want clients to access the entire internet through the VPN (full-tunnel), you’ll need a NAT rule to masquerade VPN traffic when routing through the WAN, and a policy to permit 0.0.0.0/0 via the VPN
• For split-tunnel, minimize rules to only the requested subnets to reduce exposure

A simple rule set example: WireGuard on Docker

• WAN: allow UDP port 51820 to the OPNsense public IP
• WG0 (WireGuard interface): allow all traffic from 10.0.0.0/24 to any. Or tailor to specific subnets
• LAN: allow traffic from VPN subnet (10.0.0.0/24) to internal networks as needed

If you use NAT, add a outbound NAT rule to translate VPN traffic to WAN’s IP on the correct interface.

Below is a simple comparison of two common setups you might consider:

Table: Split-tunnel vs Full-tunnel for WireGuard on OPNsense

• Split-tunnel

• Traffic to VPN subnets only is routed through the VPN WireGuard on Ubuntu

• Public internet traffic goes directly from the client to the internet

• Pros: lower bandwidth usage on VPN server, simpler routing

• Cons: client traffic is not fully encrypted to the internet. May complicate access control

• Full-tunnel

• All client traffic is routed through the VPN WireGuard on Unraid: a practical guide to setting up secure VPN access

• Pros: all traffic is encrypted to the VPN, easier to enforce monitoring

• Cons: higher bandwidth usage on VPN server, potential performance impact

Client configuration: users and devices

For remote users:

• Each user device generates its own key pair
• Create a peer entry in OPNsense for each user, with the user’s public key and Allowed IPs (for example, 10.0.0.3/32)
• On the user device, install a WireGuard client (available for Windows, macOS, Linux, iOS, Android)
• Create a tunnel using the OPNsense WG endpoint as the endpoint address, and configure the local allowed IPs to receive the VPN IPs (e.g., 10.0.0.3/32)
• If you’re using a dynamic IP on the user side, rely on a dynamic endpoint approach or use a DNS-based endpoint with endpoint address

Frontend and backend users can share the connection profile or QR code for quick setup on mobile devices.

Monitoring, security, and maintenance

After you have WireGuard up and running on OPNsense, ongoing management is essential:

• Monitor the WireGuard status page for peer connectivity and keepalive stats
• Review logs for any failed handshakes or authentication issues
• Periodically rotate keys (especially for compromised devices) and update peer entries accordingly
• Ensure firewall rules remain tight. Remove any peers that are no longer in use
• Keep OPNsense and its plugins updated to benefit from security fixes and feature improvements
• Consider enabling monitoring alerts for unusual activity or failed VPN connections

Security hygiene tips:

• Use strong, unique keys and do not reuse keys across peers
• Use ephemeral or short-lived credentials if your workflow supports it
• Restrict VPN access to only the necessary subnets and services
• Regularly back up WireGuard configurations and key material

Troubleshooting common issues

If you run into trouble, here are common checks:

• Verify that the local endpoint is listening on the chosen port and that the public IP is reachable
• Confirm peer public keys and allowed IPs align with the intended traffic
• Check firewall rules for the WireGuard interface and ensure they permit the VPN traffic
• Validate NAT settings if you’re using full-tunnel and need outbound masquerading
• Look for address conflicts if multiple peers try to use the same Allowed IP
• Use tools like ping and traceroute from a client to verify connectivity through the VPN

OPNsense offers helpful diagnostic tools, such as the WireGuard status page, which shows which peers are connected and the data counters, making it easier to spot misconfigurations.

Final recommendation

WireGuard on OPNsense is a strong choice for a modern, fast, and straightforward VPN solution. If your goal is a lightweight remote access or site-to-site connection with strong cryptography and simple key-based authentication, it’s worth implementing. Plan your topology, configure a dedicated VPN subnet, set robust firewall and NAT rules, and monitor the system to keep it secure and reliable. Start with a single remote peer or a small site-to-site link, test thoroughly, and then scale as needed. With careful setup, WireGuard on OPNsense delivers a secure, high-performance VPN foundation you can rely on.