How to setup WireGuard on OPNsense

This guide was created by a community member and reviewed by us. Firmware and router interfaces may change over time, so some steps may differ depending on your device or version.

Prerequisites:

1. OPNsense version must be 26.1 or newer
2. You will need a WireGuard config for the location you selected in the WireGuard generator

Setup

1. Open OPNsense at 192.168.1.1 (by default)

2. Log in (username is root and password is opnsense by default)

3. Go to VPN → WireGuard → Peers

4. Add a Peer

5. Enter the name of your WireGuard configuration in the Name

   • Example: xeovo-fi

6. Open your WireGuard config file

   • Example: xeovo-fi.conf

7. Copy and paste the PublicKey into the Public Key

   • Example: xfh8/RmqPebvYvYmO89L9mR6X0Ff+bU4aE8Vb3XWlzA=

8. Copy and paste the AllowedIPs into the Allowed IPs

   • 0.0.0.0/0,::/0

9. Copy and paste the Endpoint without the port into the Endpoint address

   • Example: fi.gw.xeovo.com

10. Copy and paste only the port from the Endpoint into the Endpoint port

    • Example: 51820

11. Save the Peer

12. Go to Instances

13. Add an Instance

14. Click Advanced Mode

15. Enter the name of your WireGuard configuration in the Name

    • Example: xeovo-fi

16. Copy and paste the PrivateKey into the Private Key

    • Example: gA3Xb8mR9KeVbYv2Om89L9mR6X0Ff+bU4aE8Vb3XWlzA=

17. Enter the same port as in the Endpoint port into the Listen Port

    • Example: 51820

18. Copy and paste the DNS into the DNS servers

    • Example: 10.0.0.20,fd64:e20:68a2::20

19. Copy and paste the Address into the Tunnel Address

    • Example: 10.134.162.183,fd64:e20:68a3::6:a2b7

20. In Peers, select the previously created Peer

    • Example: xeovo-fi

21. Save the Instance

22. Check the Enable WireGuard box, then click Apply

23. Go to VPN → WireGuard → Status

24. Connection status must be OK — check the Handshake Age, it should show a value

25. Go to Firewall → NAT → Outbound

26. Select the Hybrid outbound NAT rule generation mode and click Save

27. Add a Rule

28. In Interface, select WireGuard (Group)

29. In Source address, select LAN net

30. In Translation / target, select Interface Address

31. Save the Rule

32. Apply changes

33. Verify VPN connection, visit DoesMyVPN.work