How to set up a Road Warrior VPN with WireGuard in OPNsense

OPNsense and pfSense share many of their features and functionality with one another. Aside from them being based on FreeBSD, OPNsense is actually a fork of pfSense. So their similarities should come as no surprise.

Netgate, the company behind pfSense’s development, recently changed its business model. It now develops and distributes a premium version of pfSense (pfSense Plus) that includes extra proprietary features alongside the fully open-source version (pfSense Community Edition). Because of that, many pfSense users fear pfSense CE will slowly be abandoned.

And that has caused many pfSense users to jump ship (or to consider switching) to OPNsense. But while they’re very similar to one another, and you can achieve most of the same things on both systems, their configurations have diverged quite a bit by now. And many new OPNsense users coming from pfSense, are wondering how to reproduce the functionality they relied on in pfSense.

This post will explain how to configure a road warrior VPN using WireGuard in OPNsense. This guide assumes you have a working OPNsense configuration with working WAN and LAN interfaces and are using the Unbound DNS Resolver for DNS resolution.

Let’s get started.

Installing WireGuard

WireGuard is an add-on package (called a plugin) in OPNsense . So we first need to install the WireGuard plugin.

From the side menu, select System > Firmware > Plugins. The Plugins page is displayed.
Scroll down the page until you see os-wireguard, and click the + sign to its right. The installation begins.
Once the installation is complete, you should see ***DONE*** at the bottom of the installation window.

Configuring the WireGuard package

Before we get into our configuration, it’s important to understand that WireGuard doesn’t use the typical server/client dichotomy used with both IPsec and OpenVPN. With WireGuard, every participant in the network is a node that may communicate with the other nodes according to its access control list (ACL). Despite that, we’re going to treat the “OPNsense node” as our server because this makes sense – particularly in a road warrior setup.

Setting up the OPNsense node/server

From the side menus, select VPN > WireGuard. The main WireGuard settings page is displayed.
By default, we are on the General page. Select the Local tab. The Local Tunnel page is displayed.
Click the + sign to add a new WireGuard tunnel. The Tunnel Configuration page is displayed.
Enter a name for your local tunnel in the Name field.
Leave the Public Key and Private Key fields blank. The keys will be automatically generated upon saving.
Enter a port in the Listen Port field. The default is 51820.
Enter 1420 in the MTU field. This setting is required becauseWireGuard has a maximum transmission unit (MTU) of 1420. So, as you send and receive data over the connection, if a datagram exceeds 1420 bytes, it will be fragmented, which can break the connection.
Leave the DNS Server field empty. The DNS server will be set on our client.
In the Tunnel Address field, enter the IP address of the “server node.” Make sure to use a subnet that’s not already in use on your system and give it a /24 subnet mask. I will use 10.15.10.1/24.
Click Save. You’re taken back to the main WireGuard settings page.
We can see our tunnel has been created. Click Apply.

Generating our peer’s WireGuard key pair & PSK

Each peer needs to have its own public/private key pair. We auto-generated a key pair for the “server” node when we saved the tunnel. But because there’s no key generation mechanism in the peer settings, we’re going to perform a small hack to generate our peer’s key pair. We will download the official WireGuard client app and create a dummy configuration just for key generation. Once we copy the keys, we simply delete the configuration.

From the WireGuard client app, click the + sign on the bottom left.
Select Add Empty Tunnel… to create a new configuration. This automatically generates a new key pair.
Copy and paste the public and private keys into a text file and discard the configuration.

Generating a pre-shared key (PSK)

For added security, we will configure our peer to use a PSK. To do that, we are going to need to access the OPNsense Shell, So we’ll start by enabling SSH access in OPNsense.

From the side menus, select System > Settings > Administration.
Scroll down to the Secure Shell section.
Tick Enable Secure Shell. Because this is a test system, I will simply be using password login for the root user. But I would strongly recommend you create another user with fewer privileges for shell access and would also recommend using SSH keys to log in rather than a password. Were this not a test system, I would follow the above advice and not tick the Permit root user login and the Permit password login boxes.
Click Save at the bottom of the page.
Launch a Shell on the computer through which you’re accessing the OPNsense GUI.
Type: root@<your OPNsense IP address>. If you’re using SSH keys to login, you should login automatically. If not, you will be prompted for your password. The OPNsense console menu is displayed.
Type 8 (Shell) for ssh access.
Type: wg genpsk. Your PSK is displayed below the command. Copy and paste it to the same text file as the WireGuard key pair. Your text file should now contain your public and private keys as well as your PSK. We will use these in the next step.

Creating a remote peer

Now that we have our keys, we can go ahead and create our peer (called Endpoints in OPNsense).

Select the Endpoints tab. The Endpoints page is displayed.
Click the + sign. The Endpoint Configuration page is displayed.
Tick the Enabled box.
Enter a name for your peer in the Name field.
Paste the public key from the public/private key pair we generated earlier in the Public Key field.
Paste the third key we generated as a PSK in the Shared Secret field.
Enter your peer’s WireGuard IP address. It should be in the same subnet as our local tunnel (the “server” node) and should have a /32 subnet mask. I will use 10.15.10.5/32.
Enter the IP address of the local tunnel (the “server” node) in the Endpoint Address field.
Enter 51820 in the Endpoint Port
Enter 25 in the Keepalive Interval field.
Click Save. You’re taken back to the main Endpoints settings page.
We can see our peer/endpoint has been created. Click Apply.

Linking our remote peer to the local tunnel

While we’ve created our local tunnel and our peer, we still need to link them so they can work together.

Select the Local tab. The Local main settings page is displayed.
Click the pencil icon to edit the tunnel. The Local tunnel configuration page is displayed.
From the Peers drop-down menu, select iPhone_Peer (or whatever name you provided your peer).
Click Save. You’re taken back to the Local main settings page.
We can see our peer has been added to the tunnel configuration. Click Apply.

Starting the WireGuard service

Now that our local tunnel and remote peer are properly configured, we need to start the WireGuard service.

Select the General tab.
Tick the Enable WireGuard box and click Apply.

Checking the status of our WireGuard tunnel

Now that we’ve started the WireGuard service let’s make sure it’s running properly.

Select the Status tab. The WireGuard Status page is displayed.
We can see that our tunnel is up and running. But there are still a few steps to complete before we can actually start passing traffic through our WireGuard tunnel.

The next thing we will do is configure DNS.

Configuring DNS access

We will be using the built-in DNS Resolver (Unbound) for DNS. Because we didn’t create an explicit interface for WireGuard, we can’t set Unbound to bind to that interface. Instead, we will create an ACL allowing our WireGuard subnet to use the DNS Resolver. And we will set our client app to use OPNsense itself as its DNS server.

From the side menus, select Services > Unbound DNS > Access Lists. The DNS Resolver’s Access Lists settings page is displayed.
Click the + sign to add a new access list. The Access List configuration page is displayed.
Enter a name for your access list in the Access List name field.
Make sure the Action drop-down menu is set to Allow.
In the Networks fields, enter your WireGuard subnet with a /24 subnet mask. You can optionally add a description.
Optionally add a description in the Description field.
Click Save. You’re taken back to the main Access List settings page.
We can see our access list has been created. Click Apply Changes.

Enabling port forwarding and firewall rules

Our next step is configuring OPNsense to allow our remote peer to connect and for its traffic to be allowed through the firewall. We’re going to add some port forwarding rules to enable this.

From the side menus, select Firewall > NAT > Port Forward. The main NAT Port Forwarding settings page is displayed.
Click the + sign. The Port Forwarding rule configuration page is displayed.
From the Interface drop-down menu, select WAN.
From the TCP/IP Version drop-down menu, select IPv4.
From the Protocol drop-down menu, select UDP.
From the Destination drop-down menu, select WAN address.
From the Destination port range drop-down menus, select Other and enter 51820 in both port fields.
From the Redirect target IP drop-down menu, select Single host and enter the WireGuard node/server’s interface address (10.15.10.1).
From the Redirect target port drop-down menu, select Other and enter 51820 in the port field.
Enter a description in the Description field.
Make sure that the Filter rule association drop-down menu is set to Add associated filter rule. This will create a corresponding rule on our WAN interface automatically.
Click Save at the bottom of the page. You’re taken back to the main NAT Port Forward configuration page.
We can see that our port forward rule has been created. Click Apply Changes.
Our port forward rule has been applied. Let’s now make sure our WAN rule has been automatically added.
From the side menus, select Rules > WAN (we’re already in the Firewall section.) The main WAN Firewall rules page is displayed.
We can see that our WAN rule has indeed been added.
From the side menus, select WireGuard (Group) (we’re already in the Firewall > Rules section.)
The WireGuard (Group) firewall entry is automatically generated as soon as you create a WireGuard interface. The rules in this tab apply to all WireGuard interfaces you add to your system. It is distinct from the standalone interface tab you would have if you had assigned the WireGuard interface on the system, like the LAN interface. If we wanted to use the WireGuard interface as a gateway, this would have been useful. But because we’re going to be using the OPNsense WAN interface as our gateway, there’s no need to assign the interface, we can use the grouped WireGuard entry to allow traffic on our WireGuard interface. Click the + sign to add a new firewall rule. The FIrewall Rule configuration page is displayed.
Make sure the Action drop-down menu is set to Pass.
Make sure the Interface drop-down menu is set to WireGuard.
Make sure the Address Family drop-down is set to IPv4.
From the Protocol drop-down menu, select Any.
From the Source drop-down menu, select Network and enter your WireGuard subnet and a /24 subnet mask. In my case, this is 10.15.10.0/24.
From the Destination drop-down menu, select Any.
Click Save at the bottom of the page.
You’re taken back to the main Firewall Rules configuration page and we can see our firewall rule has been created. Click Apply Changes.
Our firewall rule has been applied, and our remote peer should be allowed to connect, and its traffic should be allowed through the firewall. Our next step will be to configure our remote peer (client). We’ll be doing this in the official WireGuard app for iPhone.

Configuring our remote peer (client app)

Download and install the WireGuard app for your device. I’ll be using an iPhone for this tutorial.
From the app’s main screen, click Add Tunnel. A pop-up menu appears.
Select Create from scratch.
Under Interface, enter a name for your connection in the Name field.
Copy and paste the peer’s private key in the Private Key field. The public key will be populated automatically.
Enter the peer’s IP address in the Address field. This is 10.15.10.5/32 in my case.
Enter the port number in the Port field. In my case, this is 51820.
Enter your OPNsense box’s IP address in the DNS field. This is 10.15.1.1 in my case.
Under Peer, enter the “server” node’s public key in the Public key field.. You can copy it from the Tunnels tab.
Enter the peer’s pre-shared key in the Preshared key field.
Enter 0.0.0.0/0 in the Allowed IPs field. This will pass all traffic through the WireGuard tunnel.
In the Persistent Keepalive field, enter 25.
Click Save at the top.
All that’s left is to enable our connection and see if it works.

Checking the status of our connection

Now that our remote node is connected let’s check the WireGuard service’s status in OPNsense to make sure everything is working properly.

From the side menus, select VPN > WireGuard. You’re taken to the WireGuard main settings page.
Select the Status tab.
We can see that our tunnel is up, and our remote peer is connected.
To make sure the WireGuard tunnel is using your OPNsense WAN as its gateway, you can check your IP online. The IP address displayed should be your WAN IP address.

Adding a WireGuard widget to the OPNsense dashboard

You can add a WireGuard widget to your OPNsense dashboard to be able to quickly glean information on your WireGuard connections from the OPNsense dashboard

From the Dashboard, click Add Widget at the top right of the page. The Available Widgets window is displayed.
Select WireGuard from the list and click Close.
Click Save Settings at the top right of the page to load the widget.
Once loaded, the widget displays the name of your local peer (our WireGuard “client”), the interface, the endpoint name (our WireGuard “server”), the endpoint’s public key, and the time the latest handshake occurred.

Wrap Up

So we successfully set up a road warrior VPN with WireGuard in OPNsense. That allows you to browse the internet through your home connection from anywhere. And you can also access your home network and any of the resources sitting behind it (servers, databases, other computers) from anywhere.

Enjoy, and stay safe.

See also: