This was a great tutorial, thanks a lot! For people with newer versions of Opnsense (Apr 2024), there are a few main differences: - There will be two wireguard plugins, use os-wireguard, not os-wireguard-go *. - "Local" tab is now called "Instances" tab - "Endpoints" tab is now called "Peers" tab - On the "Edit Instance" form, you will need to click the cog to generate the keypair. It does not auto-generate on save anymore as described in the video. Everything else is exactly the same (fields, buttons, configurations, etc); just follow the video. --- * As of October 2023, the "go" version is on a deprecation path and the code is being moved to the kernel version. According to Franco (core maintainer of Opnsense): "[...] the wireguard and wireguard-go plugins are no longer the same code base with go variant being old and deprecated [...]"

@0x2142

2 ай бұрын

Thanks so much for sharing the updates & differences between versions!

@RomainQ

Ай бұрын

oof that "add isntance" button was hard to find

You're going to go ahead and go ahead real quick real quick because you went ahead.

Wow. After messing with this for hours this video explained it all in 20 minutes. Thanks!

I agree with the rest of the comments. This is hands down the best video and explanation of setting up wireguard on OPNsense FW that I have ever seen. Thank you for taking the time to not only show us how to do the setup, but you explain why we set the things we need to and what the ramifications are. Thank you.

Nearly gave up trying to set WireGuard up on my OPNsense box. Watched your video and hey presto - connected straight away. Thank you so much!!!

Amazing!!! Was beating my head on the desk trying to figure out how to configure wireguard on OPNsense...your video had me doing it in minutes!!!!!

HOLY CRAP, this is by far the best tutorial on how to setup Wireguard on Opnsense ever. You're the man.

@0x2142

Жыл бұрын

Thanks so much for saying so! 😊 Glad it was helpful!!

@albertbardewyck1678

Ай бұрын

@@0x2142 I can confirm that. I followed German instructions, none were as understandable as yours, thank you

This video just helped me finally get WireGuard set up properly! I just started learning basic Linux and networking stuff about two weeks ago, and this was one of my goals - to set up my own VPN and cancel my SurfShark subscription. Thanks for the support in reaching this goal :)

@0x2142

Жыл бұрын

Awesome! Glad to hear it helped & good luck with learning the new skills! Both of those topics are a lot of fun 😊

the best video. you're the only one that provides a short description of what each config field means in a practical sense, as well as the different results of different settings you could use. much better than blindly following someone's config, which leads to difficulties troubleshooting being a non-network person

@0x2142

Жыл бұрын

Thank you so much! I really appreciate your comment & glad it was helpful!! ☺️

@misc_projects

6 ай бұрын

I completely agree. This is the most direct and informative tutorial I've seen after watching many other. It even worked on v23, just a few menu differences in the wireguard config tabs.

Thank you so much for this! I was struggling to get Wireguard working properly but this explained everything I was missing.

I had been trying to get WireGuard setup on my new install of opensense and it had been awhile since I had done it before. This video nailed it. Thanks.

Such a well done video. So well explained. Good job! I'm up and running!

Just wanted to say I tried this a few times and each time couldn't get it to work. Your video was so clear and concise I got it working on the first shot. Subscribed!

@0x2142

Жыл бұрын

Awesome! Glad to hear it helped!!! 😊

@bilinz

Жыл бұрын

@@0x2142 would love to see more content on OPNsense. It's pretty lacking on KZread compared to pfsense

@0x2142

Жыл бұрын

Thanks for the feedback 👍. I've been debating doing more - if you have any specific requests or suggestions, I'm open to ideas!

@bilinz

Жыл бұрын

@@0x2142 maybe a video on setting up unbound with Adguard?

Thank you bro, was getting mixed up on where the public keys went and this video sorted that out.

Thank you so much for the video! All of this still works, the only difference is now in OPNSense v23.7.7_3 the WireGuard tabs are "Instances" instead of "local" and "Peers" instead of "Endpoints".

Wow awesome video! Nice way to explain quickly what we want to achieve with effective and to the point instructions.

Thank you very much for the tutorial, took me a moment but i did manage to connect to my PureVPN provider. Have a nice day!

This was the info I needed. Everything is working now. Thank you :)

I like the way you graph things :)

Thanks for the very nice guide. Got it working now 👍

Excellent video! Very helpful.

Thank you very much for this awesome explanation!

this helped me a lot. thank you!

fantastic tutorial! thanks man

OPNSense is similar to PFSense so was able to get up and running, Thanks

...great video! Thanks so much for this!

Thank you very much! It helped a bunch!

IT WORKS! Thank you!

Nice, you uploaded this video just as I wanted to setup WireGuard instead of OpenVPN.

@0x2142

2 жыл бұрын

Haha - Great timing, huh? 😊 Good luck with the setup!!

@bahadirm

2 жыл бұрын

@@0x2142 Works flawless now, even on my phone. With OpenVPN I couldn't get internal hostnames to work on Android.

very good explained video man 👍👍

Great video

good guide, thanks man

Thank you so much!

OPNsense를 처음 사용해 봐서 WireGuard 구성이 막막했는데 성공적으로 구성했습니다. 좋아요와 구독 누르고 갑니다.

Thank you for this video :)

Thank you very much 🙂

Just looking to set this up and came across this video. Main differences: There are two packages available to install - Wireguard and Wireguard GO. Installed the first only to get a warning that the software was deprecated and due to be discontinued after 2023. As its 2024 I installed the GO version. Both resulted in an interface with only 3 tabs instead of the 5 shown in this video.

Thanks!

@0x2142

Жыл бұрын

Hey there! Thanks so much for your support 😊

THANKS SO MUCH, I can see what i did wrong now xD

I use my proxmox host and setup on this an Debian 11 Container with Wireguard. Now can access my home network behind CG-Nat with my smartphone that connect to LTE mobile network. Thx to IPv6

this is great tutorial however i cannot ping any hosts behind the LAN from the wireguard VPN, everything checks out OK as per you guideline. Anything else i'm missing?

hello thnx! fantastic video; but how can i setup client whit QR code?

hello, could you show us how to generate access report in OPNSENSE??

Thank you for this very detailed video! Can this procedure also being extended to setup a WireGuard Site-to-Site connection with OPNsense? Or do i just have to perform the same interface and firewall settings on the "client OPNsense" device to make it work?

@0x2142

Жыл бұрын

Yup - I haven't done that specific config yet, but my understanding is that you would just mirror the OPNsense config on both firewalls, then have each device add the other as a peer rather than the client devices.

Hello! Thanks for your video!! But I had some problems... I followed your tutorial exactly, but the handshake on the client is not completed between OPNsense. Has this ever happened to you?

Great tutorial!! Windows client works great, connects and I can access my network... Android sending and receiving handshakes are fine... but cant access anything on my network. Anyone got any suggestions???

its hard to find good opnsense stuff im happy you did this id love to chat sometime as im new to wg myself and im trying to get a few things i cant find tuts for sset up like url > ip but internally only waf and hardening my security to host games and apps but not have to worry about bad guys as i have https and redirects

@TwinTailTerror

Жыл бұрын

if ya reply here with a discord i'll come =3

Worked, except for DHCP - had to set gateway and dns in Windwos. Also why are you using /32 subnets?

greetings friend, if my isp provider does not give me a public ip but if I can access the internet, is there another way to use wireguard?

How do i setup wireguard to connect to my vpn provider and route ALL LAN traffic throuh the vpn? with kill switch

Hey! What a great tutorial, congrats on that. I have one question, Do you need to have a public IP from your ISP for this tutorial to work? Or Could I just use some DDNS service to bypass that? Currently I didn't have a public IP address from my ISP. TIA

@0x2142

Жыл бұрын

Hey there, thanks for the comment! So to clarify - do you not have a public IP at all, or just not a static address? If you have a dynamic IP, then yeah you can use a DDNS service to update your public IP. That's how I've got mine set up now at home. If you don't have a public IP address at all, and you're getting a NAT from your ISP - then it may not work (or require a bit more setup).

@user-xg1dy

Жыл бұрын

@@0x2142 Thanks for the reply. I'm a network newbie, I tried with duckdns (it showed a cached IP sometimes green sometimes red) When I tried to connect from the wireguard app, it shows "sending handshake initiation" but has no response. When I'm in my house (same network) it connects succesfully, so the Wireguard tunnel is OK I think. Could you please guide me if I need to configure extra firewall rules or something else to achieve the connection via a DDNS server? How do I know if I have NAT from ISP or dynamic IP? Thanks!

Followed step by step... I can establish a connection, I can ping and nslookup stuff with my pihole at the house showing as server... but I can't browse anything on the web.

@rpm10k.

Жыл бұрын

and weirdly, it's showing traffic from 10.50.0.x to my internal 192.168.x.x server i'm tryng to log into as passing on the firewall logs.

I want to use an ASUS router as server and OPNsense as client (P2P). I can't find any video on how to set this up. I have manage to make a connection between the routers. Now I need to set the correct rules and maybe even a gateway for it to work properly. Any suggestions?

Hello. Thank you for this video. I've got one question: Is it possible to setup opnsense that it connects to an VPN Provider as client? So that all of my devices that are in my network will automaticly use the vpn connection? I've searched so many times, but I've only found tutorials how to setup opnsense's wireguard as a VPN Server but not as a Cient to an external VPN Server Provider

@0x2142

Жыл бұрын

Hi there - In the video I do show configuration for the VPN server & VPN clients. If you were looking to connect to a different external VPN provider, they would need to support WireGuard - which is a different protocol than traditional IPSec VPNs. So there isn't any native compatibility there.

Just an FYI: on the ios app it says allowed ip's are optional. It would not work until I entered 0.0.0.0/0 in case anyone else has this problem.

Any chance to get help with it? It dosnt work for me.OpenVpn is working fine, but cant get connection with wireguard...

Great video. thank you. Shouldn't there be a firewall rule on WG1 interface to allow traffic to Lan subnets? without it I couldn't even ping the VPN Headend IP.

@0x2142

Жыл бұрын

Hello there - Thanks for the comment! Yes, there should be firewall rules on the WG1 interface - depending on what traffic you want to allow. In the video, I did create a rule to allow all traffic: kzread.info/dash/bejne/lGlsstKueda3Y6Q.html

@Suriprofz

10 ай бұрын

rule doesnt work @@0x2142dont we need a lan rule?

Hmm not sure why this isn't working for me. For some reason the Wireguard service in OPNsense does not start? I've re-installed the Wireguard plugin and retried this guide many times but still no joy. Any suggestions? Thank you

I followed this steps but using it on iPhone WG client. I can’t get the handshake to work.

Thank you for the tutorial. I had a Wireguard setup previously that used a duckdns domain name to update my public IP every time my ISP changed it. Do you know if that is possible with the OPNsense add-on as well? Cheers, Martin

@0x2142

Жыл бұрын

Hello! Yes, my setup is fairly similar to that. I am using Wireguard on OPNSense, with a dynamic DNS entry for my public IP. OPNsense has a built-in dynamic DNS plugin, and it looks like it does support duckdns.

@martinzipfel7843

Жыл бұрын

@@0x2142 Awesome. Thanks for the quick reply. I have set up the duckdns dynamic dns I just wasn't sure if that gets past on to the Wireguard add-on because no where in the setup there is a reference to the dynamic dns domain (or I missed it). Will do some playing around and see if it works. Thanks

@0x2142

Жыл бұрын

Ahh okay. Yeah wireguard just gets enabled on the public-facing interface. It doesn't care about the IP or domain name, so there isn't anywhere to configure that in OPNsense.

@martinzipfel7843

Жыл бұрын

Ok, I think it is that "Tunnel Address" setting in the interface that threw me off.

Hey! So im running into a issue where the client can connect and access the firewall gui but nothing on lan, My clients are in fulltunel mode.. IN the wg logs I see this: "Error wireguard /usr/local/opnsense/scripts/Wireguard/wg-service-control.php: The command '/sbin/route -q -n add -'inet' '10.59.59.1/24' -interface 'wg1'' returned exit code '1', the output was ''" Do you know what this could cause?

can you make a client on your router use wireguard without installing the wireguard client? that was something you can do on consumer routers that i liked.

Thank you for this tutorial. It is very comprehensive and it worked at once. The only issue I am currently faceing in some Windows client(0.5.3) the wireguard client does not connect(handshake). I also tried wireshark to capture any packets but upon wireguard client activation, not a single packet is trasmitted. Any idea why is this happening?

@0x2142

9 ай бұрын

Hmm - I haven't seen that on my Windows clients yet, and they are running the same version. With the pcap, I wonder if perhaps something else on the PC is blocking the traffic?

@DimitrisNikolakakos

9 ай бұрын

@@0x2142 I managed to solve this! I added the PersistentKeepAlive = 20 in the client config and it worked instantly!

Great tutorial. Not sure why but my widget shows an additional client for the wireguard instance that is always present, where yours doesn;t.

@0x2142

8 ай бұрын

Mine does this too with the recent OPNsense firmware

@AlexeiWatson

8 ай бұрын

@@0x2142 well that's good, it means I didn't miss any steps! Really happy to have this working, thanks.

thanks great guide, i managed to sort everything as per your tutorial. however, i cannot ping any hosts on the LAN (192.168.1.x) my tunnel ip is 10.0.0.15/32 . am i missing something?

@Suriprofz

10 ай бұрын

same here, did u fix it/

Good sir - I recently discovered a problem where I don't have internet access when connected with either my laptop or iphone. I suspect its a firewall rule or nat configuration problem. There are only 100 different reddit posts about it but I can't seem to get it to work. Any insight is appreciated! Thanks!

@bigneilh

Жыл бұрын

I figured it out - i followed the doc from opnsense but in the process of reading other peoples problems I removed the DNS entry for the client. It not works properly! Thanks!

@8:10 how can I make it to where it only connect to my certain server at home and not the whole network?

@0x2142

11 ай бұрын

The best way would be to adjust the client configuration. For example if you had a server at 10.10.10.2 - the client's allowedIPs field should be set to 10.10.10.2/32. This would mean only traffic to that one address would be sent over the VPN.

Where are you getting all these ip addresses from?

Hey, the handshake works on my android phone but for some reason i can't connect to any website but in the firewall logs i see nothing blocked.

@nairol203

4 ай бұрын

I figured it out. I had manual outbound nat enabled. It works now after i switched to automatic/dynamic outbound nat!

But with the vpn it can goes to the lan of the opnsense or you have to put a route ?

@0x2142

Жыл бұрын

Yeah by default it should be able to reach the LAN. Whatever the client has set for AllowedIPs is what will be forwarded over the VPN. So 0.0.0.0/0 would include everything, LAN too.

@samollojr-er7cb

Жыл бұрын

@@0x2142 ok thanks and i have also à site to site wireguard on Two opnsense is it possible with the client to cross the other vpn site to site and Connect to other site?

I am a bit confused about the IPs. The allowed IP's. And the client DNS IP's. And the address ip range you gave to the client

@0x2142

Жыл бұрын

Hi there - So Allowed IPs acts as a filter or access-list, which tells the wireguard config what IP addresses will be allowed over the tunnel. So on the firewall side, I set Allowed IPs to 10.50.50.15 for example - since that's the VPN address I am assigning to the client. On the client side, however, I set Allowed IPs to 0.0.0.0/0. This tells the client to forward ALL traffic to all destinations over the tunnel. The client DNS IP addresses are whichever DNS servers you would like the client to use when it's connected to the wireguard VPN. In my case, I have DNS servers that are hosted on the server side behind the firewall. So I wanted the clients to use those DNS servers once they connect to the VPN. For the client addresses, I used the 10.50.50.0/24 subnet. This can be any RFC1918 address space that you want it to be - so long as it doesn't overlap with anything used by the firewall. These addresses are only used to connect the client to the wireguard VPN server. Hope that helps!

hello im facing issue with as no handshake complete,in interfaces it shows red cross with ethernet autoselect how to solve this

@trustes89

Жыл бұрын

same!!!!! :( cant get it to work

I got a mullvad VPN and it comes with a windows app that has wireguard, can i use that to avoid all the above? Is it same thing?

@0x2142

Жыл бұрын

Hello - It's kinda the same, just depending on what you intend to accomplish. Looks like mullvad is a generic VPN provider that focuses on securing your traffic to the internet - and they happen to use WireGuard to accomplish that. In my video, I focus on setting up WireGuard VPN to a firewall - primarily for remote access back to a home or corporate network. So if you're looking to access home network resources, then you might need to follow a similar process to what I shared. But if you are just looking to have secure / private internet access, then the mullvad VPN will work just fine. Hope that helps!!

can you make a new guide? new version is giving me trouble

@patrickFREE.

7 ай бұрын

Why?

not using the addresses 192.168... confuses me so much 😅😅

no IPv6, downvoted

Amazing so unintuitive this is. Of cause anyone can follow the guide and get it running. But why not make is quick and easy to do. I have wireguard running in UNRAID. It´s literally 4-5 clicks in GUI to install and setup. Then download configuration file and import into windows client. Or scan a QR code if phone is the client. Thats all it takes!