Skip to content

Update opnsense-wireguard.md #709

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sunnyvibez wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update opnsense-wireguard.md #709

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 12 additions & 14 deletions src/content/pages/setup/router/opnsense-wireguard.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ weight: 61
## OPNSense WireGuard Setup Guide

<div markdown="1" class="notice notice--warning">
This guide was produced using OPNSense 20.1.
This guide was produced using OPNSense 23.7.7.
</div>

### Configure Your Environment
Expand All @@ -27,16 +27,16 @@ This guide was produced using OPNSense 20.1.

1. Log in to the [IVPN Client Area](/account/).

2. Choose a WireGuard server to connect to from our [Server Status](/status/) page. Make note of the hostname and the public key of the server.
2. On the `VPN Accounts` page in the Client Area on our website, click the `WireGuard` tab. Go to `WireGuard Server List` located under **Tools**. Choose a WireGuard server to connect to from our **WireGuard Server List** page. Make note of the IP Address and the public key of the server.

3. In the OPNSense web interface, go to `VPN > WireGuard > Endpoints` and click the `+` to add a VPN server location (Endpoint/Peer):
3. In the OPNSense web interface, go to `VPN > WireGuard > Settings > Peers` and click the `+` to add a VPN server location (Endpoint/Peer):

<div markdown="1" class="notice notice--info">
<strong>Name:</strong> A short interface name, like ivpnJapan or ivpnSeattle.<br>
<strong>Public Key:</strong> The server public key is available from the server list in the step above.<br>
<strong>Shared Secret:</strong> Leave it blank.<br>
<strong>Alloweb IPs:</strong> 0.0.0.0/0<br>
<strong>Endpoint Address:</strong> The server hostname is available from the server list in the step above.<br>
<strong>Allowed IPs:</strong> 0.0.0.0/0<br>
<strong>Endpoint Address:</strong> The server IP Address from the server list in the step above.<br>
<strong>Endpoint Port:</strong> IVPN offers different ports to connect on: 53, 80, 443, 1194, 2049, 2050, 30587, 41893, 48574, and 58237<br>
<strong>Keepalive:</strong> 25
</div>
Expand All @@ -47,7 +47,7 @@ This guide was produced using OPNSense 20.1.

### Add a Local Interface

1. In the OPNSense web interface, go to `VPN > WireGuard > Local` and click the `+` to add a local interface and enter the following:
1. In the OPNSense web interface, go to `VPN > WireGuard > Settings > Instances` and click the `+` to add a local interface and enter the following:

<div markdown="1" class="notice notice--info">
<strong>Name:</strong> A short interface name, like ivpn.<br>
Expand All @@ -60,13 +60,11 @@ This guide was produced using OPNSense 20.1.
<strong>Peers:</strong> Choose the <strong>Endpoint</strong> (VPN server location) you created in the previous step.
</div>

Click the `Save` button to generate your **Public** and **Private** keys.
Click the `Generate new keypair` button next to **Public key** to generate your **Public** and **Private** keys.

2. Click the pencil icon to edit the local interface you created in the previous step and make note of your **Public Key**.
2. Make note of your **Public Key**.

![](/images-static/uploads/opns-wg-3-2-local-interface.png)

3. On the `VPN Accounts` page in the Client Area on our website, click the `WireGuard` tab. Go to `WireGuard Key Management` located under **Tools**. Click the `Add New Key` button. Copy the contents of the **Public Key** from OPNSense and paste them into the **Public Key**: field. Add a comment, like OPNSense if you prefer, and click the `Add Key button`.
3. On the `VPN Accounts` page in the Client Area on our website, click the `WireGuard` tab. Go to `WireGuard Key Management` located under **Tools**. Click the `Add New Key` button. Copy the contents of the **Public Key** from OPNSense and paste them into the **Public Key**: field. Add a comment, like OPNSense if you prefer, and click the `Add Key` button.

<div markdown="1" class="notice notice--warning">
Be sure to copy the <strong>Public Key</strong> and not the <strong>Private Key</strong>. The <strong>Private Key</strong> must always be kept a carefully guarded secret.
Expand All @@ -82,13 +80,13 @@ This guide was produced using OPNSense 20.1.

### Connecting

1. Go to the `VPN > WireGuard > General` tab and put a check mark beside **Enable WireGuard** on the General tab, then click the `Save` button.
1. Go to the `VPN > WireGuard > Settings > General` tab and put a check mark beside **Enable WireGuard** on the General tab, then click the `Save` button.

2. Check the `VPN > WireGuard > List Configuration` and `Handshakes` tabs to see connection details.
2. Check the `VPN > WireGuard > Diagnostics` for connection details.

3. Go to the `Interfaces > LAN` page and set the `MSS` value to `1412`. Click the `Save` button at the bottom of the page, then click the `Apply changes` button at the top of the page.

4. To let you internal network clients go through the tunnel, add a **NAT entry**. Go to `Firewall > NAT > Outbound` and click `+Add` to add a rule. Check that rule generation is set to **Manual** or **Hybrid**. Add a rule and select **Wireguard** as `Interface`. `Source Address` should be **LAN net** and set `Translation / target` to **Interface address**.
4. To let your internal network clients go through the tunnel, add a **NAT entry**. Go to `Firewall > NAT > Outbound` and click `+Add` to add a rule. Check that rule generation is set to **Manual** or **Hybrid**. Add a rule and select **Wireguard** as `Interface`. `Source Address` should be **LAN net** and set `Translation / target` to **Interface address**.

![](/images-static/uploads/opns-wg-4-3-nat-rule.png)

Expand Down