The Speed of Light: OPNsense WireGuard Setup Guide

Merry Christmas everyone! A little Christmas "treat" for all...

You’ve built the fortress (OPNsense). Now you need a secure, invisible tunnel to get back inside when you’re on the road, travelling for work or on vacation!

For many years, OpenVPN was the standard. But it’s slow, bloated, and drains your battery. To be fair, it can be optimized/shaped up to be a little more performant than it used to be, however... I switched to wireguard back in 2017 and never looked back!

Enter WireGuard. It is modern, lean (4,000 lines of code vs OpenVPN’s 100,000+), and incredibly fast. It roams seamlessly between Wi-Fi and LTE without dropping the connection.

In this guide, we will build a production-ready WireGuard server on OPNsense. We will cover the cryptography basics, the "Orange Cloud" trap, and the precise firewall rules needed to make it work.

🔑 The Concept: Understanding the Keys (Read This First!)

The Ghostbusters Analogy

In the movie, you have two entities that must meet to open the inter-dimensional portal (the VPN tunnel).

Think of WireGuard keys like the end of Ghostbusters. Your Phone is the Keymaster (Private Key)—it holds the secret code and travels around with you. Your OPNsense server is the Gatekeeper (Public Key)—it sits at home waiting for the Keymaster to arrive.

You must copy the 'Gatekeeper' (Public Key) onto your phone so it knows who to look for, and you must copy the 'Keymaster's Identity' (Public Key of the phone) onto the server so it knows who to let in.

When they meet? The tunnel opens.

Technical Details

WireGuard doesn't use usernames and passwords. It uses Cryptographic Key Pairs. This confuses people, so let’s break it down.

Every device has Two Keys:

1. Private Key: The "Secret." NEVER share this. It stays on the device that created it.
2. Public Key: The "Lock." You MUST share this with the other device.

Think of it like a mailbox. You give the Public Key (the mailbox address) to your server so it can send you mail. But only you have the Private Key (the mailbox key) to open it.

🛡️ The "Who Gets What" Cheat Sheet

This table saves lives. Refer to it during setup.

What is a Pre-Shared Key (PSK)?

It is an optional (but highly recommended) second password. It adds a layer of symmetric encryption to protect against future quantum-computing attacks. If you use it, both sides need the exact same PSK.

🚧 Step 0: The Cloudflare "Orange Cloud" Trap

If you use Cloudflare for your DNS, you likely have the "Orange Cloud" (Proxy) turned on.

This kills WireGuard. Cloudflare's free proxy only handles HTTP/HTTPS (Web traffic). It drops WireGuard's UDP traffic instantly.

The Fix:

1. Go to your Cloudflare Dashboard -> DNS.
2. Create a new A-Record specifically for your VPN (e.g., vpn.corelab.tech).
3. Point it to your homelab/target IP.
4. Turn OFF the Proxy (Click the Orange Cloud so it turns Grey / "DNS Only").

Now, when you configure your WireGuard clients later, you will use vpn.corelab.tech as the Endpoint, not your main root domain.

If on v25.x, you need to install the plugin for wireguard. If you're on v26.x, skip!

🛠️ Step 1: Install the Plugin

1. Log in to OPNsense.
2. Go to System > Firmware > Plugins.
3. Search for os-wireguard.
4. Click Install (+ button).
5. Refresh the page. You will now see VPN > WireGuard in the menu.

⚙️ Step 2: Configure the OPNsense "Instance" (The Server)

We need to create the server itself. In OPNsense, this is called a Local configuration.

1. Go to VPN > WireGuard > Instances.
2. Click the + button to add a new instance.
3. Name: WG-Server or what you'd like to name it. Mine is WGRW for wireguard road warrior.
4. Public Key / Private Key: Leave blank for a second. Click the Gear Icon (Generate) next to the field. It will auto-fill both keys.
   • Action: Copy the Public Key to a notepad. You will need this for your phone or laptop later. You will re-use this public key for each 'client' you attach to this wireguard server instance.
5. Listen Port: 51820 (The standard WireGuard port). You will increment this by one or change it if you add another WG server.
6. Tunnel Address: 10.10.10.1/24
   • Note: This is a virtual internal network for the VPN. It must NOT‼️ match your actual LAN (e.g., if your LAN is 192.168.1.x, do NOT use that here).
7. Peers: Leave blank for now (we haven't created them yet).
8. Click Save.

It'll look like this:

📱 Step 3: Create the Client "Peer" (Your Phone)

Now we tell OPNsense who is allowed to connect.

1. On your Android/iOS Phone:
   • Download the official WireGuard app.
   • Open it -> + -> Create from scratch.
   • Click Generate to make a Private/Public key pair.
   • Action: Copy the Public Key from the phone app. (Send it to yourself via Signal/Email, or type it carefully or send it via another secure means).
2. Back on OPNsense:
   • Go to VPN > WireGuard > Peers.
   • Click +.
   • Name: MyPhone
   • Public Key: Paste the Phone's Public Key here.
   • Pre-Shared Key: Click the Gear Icon to generate one. Copy this! You need to put it on the phone later. C'mon, don't you want to be able to say you've already beat quantum decryption?!
   • Allowed IPs: 10.10.10.2/32
     • Critical: This assigns a specific, single IP address to your phone inside the tunnel.
   • Click Save.
3. Link the Peer to the Server:
   • Go back to VPN > WireGuard > Instances.
   • Edit your WG-Server instance.
   • In the Peers dropdown, check the box for MyPhone.
   • Click Save.
4. Enable WireGuard:
   • Go to VPN > WireGuard > General.
   • Check Enable WireGuard.
   • Click Apply.

Should look like this:

🔌 Step 4: Interface & Firewall Rules (Opening the Gates)

WireGuard is running, but the firewall blocks everything by default. Yay your firewall is working - but damn...

A. Assign the Interface

1. Go to Interfaces > Assignments.
2. You will see a new device wg0 (or similar).
3. Add a description: VPN_WG.
4. Click + to add it.
5. Click on the new VPN_WG interface name in the left menu.
6. Enable Interface: Checked.
7. IPv4 Configuration: None (It gets the IP from the Instance config).
8. Lock: Checked (Prevents interface removal).
9. Save & Apply.

B. Allow the Handshake (WAN Rule)

We need to let the phone "knock" on the front door, or it'll never establish the tunnel.

1. Go to Firewall > Rules > WAN.
2. Click +.
3. Protocol: UDP (WireGuard is UDP only!).
4. Destination: WAN address.
5. Destination Port Range: 51820 to 51820.
6. Description: Allow WireGuard Inbound.
7. Save & Apply.

C. Allow Traffic Inside the Tunnel (WG Rule)

Once the phone is connected, we need to let it access things.

1. Go to Firewall > Rules > VPN_WG (or whatever you named it).
2. Click +.
3. Action: Pass.
4. Source: VPN_WG net (or the specific IP 10.10.10.0/24).
5. Destination: any (This gives the phone access to the internet AND your LAN).
   • Security Tip: If you only want the phone to access your LAN but NOT use your home internet bandwidth, create more specific rules here.
6. Save & Apply.

D. The Outbound NAT (Crucial for Internet Access)

If you want to browse the internet through your VPN (so you look like you are at home), you need NAT.

1. Go to Firewall > NAT > Outbound.
2. Ensure you are in Hybrid or Manual mode. (Hybrid is best). I've personally never found a reason to set it to fully manual mode.
3. Click +.
4. Interface: WAN.
5. Source Address: 10.10.10.0/24 (Your WireGuard Network).
6. Translation / Target: Interface address.
7. Description: NAT for WireGuard.
8. Save & Apply.

📲 Step 5: Final Client Configuration

Now, fill in the blanks on your client devices and you'll be ready to test.

Android Setup

Go back to the entry you started on your phone.

• Interface Section:
  • Private Key: (Already there).
  • Public Key: (This is your phone's public key).
  • Addresses: 10.10.10.2/32 (The IP you assigned in OPNsense Peers).
  • DNS Servers: 1.1.1.1 (Or your Pi-hole IP 192.168.1.x if you want ad-blocking!).
• Peer Section (The OPNsense Server):
  • Public Key: Paste the OPNsense Server Public Key (from Step 2).
  • Pre-Shared Key: Paste the PSK you generated in Step 3.
  • Endpoint: vpn.corelab.tech:51820 (Your Cloudflare Grey Cloud domain).
  • Allowed IPs: 0.0.0.0/0 (This routes ALL traffic through the VPN).

Windows Setup

Install the WireGuard client. Click "Add Empty Tunnel". Paste this config (Edit the placeholders!):

[Interface]
PrivateKey = <Paste Windows Private Key Here>
Address = 10.10.10.3/32
DNS = 1.1.1.1

[Peer]
PublicKey = <Paste OPNsense Server Public Key Here>
PresharedKey = <Paste PSK Here>
Endpoint = vpn.corelab.tech:51820
AllowedIPs = 0.0.0.0/0

🕵️ Troubleshooting: The "Handshake"

The most common error in WireGuard is Silence. Because it is UDP, if the keys are wrong or the firewall is blocked, it won't give you an error message. It just... won't work.

1. Check the Handshake:In OPNsense, go to VPN > WireGuard > Status. Look for your Peer.
   • Handshake: "2 minutes ago" or similar = SUCCESS. ✅
   • Handshake: "0" or (nothing) = FAILURE. ❌

If all goes well, it should look like this:

1. If it fails:
   • Check Keys: Did you accidentally swap the Server Public Key and Client Public Key? (Refer to the table at the top!).
   • Check Cloudflare: Is that "Orange Cloud" turned off?
   • Check WAN Firewall: Is Protocol set to UDP (not TCP)?
   • Check Peer IP: Does the Allowed IPs on the client (10.10.10.2/32) match the Allowed IPs inside the OPNsense Peer config? They must match exactly.