WireGuard on pfSense: a practical guide to setting up and using WireGuard on pfSense

Introduction to WireGuard on pfSense

What WireGuard is and why it fits pfSense

• WireGuard is a simple, fast, and modern VPN protocol designed for ease of use and high performance.
• pfSense supports WireGuard as an add-on package, enabling native-like configuration within the pfSense web GUI.
• Benefits include small codebase, strong cryptography, straightforward key management, and good performance on typical hardware.

Common use cases

• Remote access VPN for individual users
• Site-to-site VPNs between branch offices
• Secure client access to services behind pfSense
• Quick, low-overhead tunnels for IoT or remote devices

Important notes

• WireGuard uses static private/public key pairs for peers and does not rely on a traditional CA.
• You’ll typically run WireGuard over UDP port 51820, but you can customize the port if needed.
• For full integration, keep pfSense and the WireGuard package up to date to benefit from security fixes and features.

Installing WireGuard on pfSense

What you need before you begin

• A pfSense installation (physical or virtual) with admin access.
• A supported hardware platform with network interfaces suitable for your VPN design.
• Internet access for package installation.

Step-by-step installation WireGuard on TrueNAS

• Log in to the pfSense web interface.
• Navigate to System > Package Manager > Available Packages.
• Search for “wireguard” and install WireGuard and the WireGuard-go backend if prompted.
• After installation, you will have a new VPN section in the pfSense menu for WireGuard.

Basic validation

• Once installed, verify that the WireGuard package shows as installed and that the kernel module (if applicable) is loaded.
• Confirm that the necessary services can be started from the pfSense Services or Status pages.

Configuring WireGuard: peers, keys, and interfaces

Key concepts

• Private key: kept on the pfSense box or the client device. Never shared.
• Public key: derived from the private key and shared with peers.
• Interface: the WireGuard interface on pfSense that carries the VPN traffic.
• Peer: any other WireGuard device you connect to, identified by its public key and allowed IPs.

Getting started with pfSense

• Create a new WireGuard tunnel (often called a Tunnel or Interface in pfSense).
• Generate a private key and a public key for the pfSense side.
• Add peers with their public keys and allowed IPs (the IPs that should be reachable via the tunnel).

Common configurations

• Remote access: pfSense acts as the server. Clients authenticate with their own private/public key pairs.
• Site-to-site: both ends run WireGuard with each end configured as a peer and appropriate allowed IPs to reach the remote network.

Example keys and IP plan (illustrative) WireGuard on Docker

• pfSense private key: generated on pfSense
• pfSense public key: derived from private key
• Client private/public key pair: generated on each client
• VPN IP range: a private CIDR (e.g., 10.0.0.0/24 or 192.168.50.0/24)
• Allowed IPs on the pfSense side: the remote network’s subnet (e.g., 10.1.0.0/16)

Security considerations

• Use a distinct VPN subnet that does not overlap your internal networks.
• Limit allowed IPs to the minimum required networks to reduce exposure.
• Consider enabling persistent keepalive (e.g., 25 seconds) to maintain NAT mappings on some networks.

Firewall rules and NAT for WireGuard traffic

Why firewall rules matter

• pfSense will block traffic unless you explicitly allow it. You must permit VPN traffic and route it correctly to the LANs you want to reach.

Typical rule setup

• On the WireGuard interface:
• Allow inbound UDP on port 51820 (or your chosen port) from any to the WireGuard interface.
• Allow related/established connections for responses.
• On the LAN or remote subnets:
• Allow traffic to the VPN subnet or from VPN subnet to LAN as needed.
• If you’re doing site-to-site, you might need rules that allow the remote network to reach internal networks and vice versa.

NAT considerations

• If you want VPN clients or sites to reach the Internet through pfSense, enable NAT (Outbound NAT) for the VPN interface or configure a NAT rule that translates VPN-originated traffic to the pfSense WAN IP.
• For site-to-site VPNs that only need internal network access, you may disable outbound NAT for VPN traffic in some configurations, depending on your topology.

Client and site-to-site scenarios

Remote access (client-to-site) WireGuard on Ubuntu

• pfSense as the server, clients connect using their own private/public key pairs.
• Each client gets a tunnel interface or a peer entry with its allowed IPs (usually a single internal client IP on the VPN subnet).
• Routes on the client must point to the VPN for the internal networks the client should access.

Site-to-site VPN

• Both ends configure each other as peers with the appropriate allowed IPs (e.g., 10.0.1.0/24 on Site A, 10.0.2.0/24 on Site B).
• Traffic between the two sites travels through the WireGuard tunnel, with NAT typically disabled on the VPN endpoints for the remote networks.
• This approach provides seamless connectivity between branches without relying on traditional IPsec tunnels.

Table: example comparison of client-to-site vs site-to-site

• Use case: Client-to-site
• Peers: pfSense (server) + multiple clients
• VPN subnet: 10.0.99.0/24
• Typical traffic: remote client to internal services
• Use case: Site-to-site
• Peers: pfSense at Site A and pfSense at Site B
• VPN subnets: 10.0.10.0/24 (Site A), 10.0.20.0/24 (Site B)
• Typical traffic: internal networks across sites

Troubleshooting common issues

• No peers or cannot connect: verify keys are correct, ensure the public key is configured on the peer, and confirm port accessibility.
• Traffic not routing: check allowed IPs, route tables on pfSense, and ensure firewall rules permit the traffic.
• VPN drops or keeps disconnecting: review keepalive settings, NAT timers, and any intermediate NAT devices that may strip UDP state.

Monitoring, maintenance, and best practices

Monitoring

• Use pfSense dashboards and logs to monitor WireGuard activity, including active peers, connection status, and traffic statistics.
• Consider enabling alerting for failed connections or unusual activity.

Maintenance WireGuard on Unraid: a practical guide to setting up secure VPN access

• Regularly update pfSense and the WireGuard package to benefit from security patches and improvements.
• Rotate keys periodically, especially if a device is decommissioned or a key is suspected to be compromised.
• Back up your WireGuard configuration and key material in a secure, off-site location.

Best practices

• Use distinct, non-overlapping subnets for VPNs and internal networks.
• Keep a clear inventory of peers, their roles, and the allowed IPs for each peer.
• Prefer minimal exposure: restrict allowed IPs and ports to what’s necessary.
• Document your topology and settings to simplify future changes or troubleshooting.

Final recommendations

If you’re looking for a modern, fast, and straightforward VPN option on pfSense, WireGuard is a strong choice. It integrates neatly with pfSense’s firewall and routing, supports both remote-access and site-to-site configurations, and tends to be simpler to manage than many traditional VPN solutions. Start with a small, test deployment to validate your topology, firewall rules, and NAT behavior, then extend to full production use with careful documentation and ongoing monitoring. For most small to mid-sized networks, WireGuard on pfSense offers an excellent balance of performance, security, and ease of administration.