How to setup WireGuard on pfSense

This guide was created by a community member and reviewed by us. Firmware and router interfaces may change over time, so some steps may differ depending on your device or version.

Prerequisites

1. pfSense version must be 2.7.2 or later
2. You will need a WireGuard config for the location you selected in the WireGuard generator

Setup

1. Open pfSense at 192.168.1.1 (by default)

2. Log in (username is admin and password is pfsense by default)

3. Go to System → Package Manager → Available Packages

4. Search for wireguard and click Install, then Confirm

5. After installation, go to VPN → WireGuard → Tunnels

6. Click Add Tunnel

7. Check the Enable Tunnel box

8. Enter a name in Description

   • Example: xeovo-fi

9. Enter 51820 in Listen Port

10. Open your WireGuard config file

    • Example: xeovo-fi.conf

11. Copy and paste the PrivateKey from your config file into Private Key

    • Example: cBPr9I+87zEMwkuIVFE0KRTPWOyGe25EKaTl3gxisSQ=

12. Copy and paste the Address from your config file into Interface Addresses

    • Example IPv4: 10.143.71.121 / 32

13. Click Save Tunnel

14. Go to the Peers tab and click Add Peer

15. Check the Enable box

16. Select your tunnel in Tunnel

    • Example: tun_wg0 (xeovo-fi)

17. Enter a name in Description

    • Example: xeovo-fi

18. Uncheck the Dynamic Endpoint box

19. Copy and paste the PublicKey from your config file into Public Key

    • Example: sb61ho9MhaxhJd6WSrryVmknq0r6oHEW7PP5i4lzAgM=

20. Copy and paste the Endpoint address without the port into Endpoint

    • Example: fi.gw.xeovo.com

21. Copy and paste only the port from the Endpoint into Endpoint Port

    • Example: 51820

22. Set Allowed IPs to 0.0.0.0 / 0 and :: / 0

23. Click Save Peer

24. Go to VPN → WireGuard → Settings, check Enable WireGuard and click Save

25. Go to Status → WireGuard Status and verify the tunnel is active — Latest Handshake should show a value

26. Go to Interfaces → Assignments, select tun_wg0 in Available network ports and click Add

27. Click on the newly added interface (e.g. OPT1)

28. Check the Enable box

29. Enter WG_VPN in Description

30. Enter 1420 in MTU

31. Set IPv4 Configuration Type to Static IPv4

32. Copy and paste the Address from your config file into IPv4 Address with a /32 mask

    • Example: 10.143.71.121 / 32

33. Click Save, then Apply Changes

34. Go to System → Routing → Gateways and click Add

35. Fill in the gateway:

    • Interface: WG_VPN

    • Name: WG_VPN_GW

    • Gateway: the Address from your config file (same as in step 12)

      • Example: 10.143.71.121

    • Click Display Advanced and check Use non-local gateway

36. Click Save, then Apply Changes

37. Go to Interfaces → WG_VPN

38. Set IPv4 Upstream gateway to WG_VPN_GW

39. Click Save, then Apply Changes

40. Go to Firewall → NAT → Outbound

41. Select Manual Outbound NAT rule generation and click Save, then Apply Changes

42. Find the rule with description Auto created rule - LAN to WAN and click the pencil icon to edit it

43. Change Interface from WAN to WG_VPN

44. Change Translation Address to WG_VPN address

45. Click Save, then Apply Changes

46. Go to Firewall → Rules → LAN

47. Click the pencil icon next to the rule Default allow LAN to any rule

48. Click Display Advanced and set Gateway to WG_VPN_GW

49. Click Save, then Apply Changes

50. Verify the VPN connection, visit DoesMyVPN.work

DNS Configuration

To use the DNS servers from your WireGuard config and prevent DNS leaks:

1. Open your WireGuard config file and find the DNS line

   • Example: DNS = 10.0.0.20, fd64:e20:68a2::20

2. Go to System → General Setup

3. Under DNS Server Settings, remove any existing DNS entries

4. Enter the DNS addresses from your config file one by one into the DNS Server fields

   • Example: 10.0.0.20, fd64:e20:68a2::20

5. For each DNS entry, set Gateway to WG_VPN_GW

6. Uncheck DNS Server Override to prevent WAN from overwriting your DNS settings

7. Click Save

DNS Resolver

1. Go to Services → DNS Resolver

2. Set Outgoing Network Interfaces to WG_VPN

3. Under DNS Query Forwarding, check Enable Forwarding Mode

4. Click Save, then Apply Changes

Disconnecting

To disconnect the VPN, go to VPN → WireGuard → Settings, uncheck Enable WireGuard and click Save. Your configuration will be preserved and can be re-enabled the same way.