Installing WireGuard Package
Log into your pfSense GUI, navigate to System > Package Manager > Available Packages, search for WireGuard and click Install. Wait until the installation completes successfully.
Creating a WireGuard Tunnel
Go to VPN > WireGuard, and click Add Tunnel. Configure the settings:
- Enable Tunnel: Checked
- Description: Provide an intuitive description (e.g., "SmartHome VPN")
- Interface Keys: Click Generate to create public/private keys. Save these securely.
- Listen Port: Default is typically fine (51820)
Save and apply changes.
Configuring Firewall Rules
Navigate to Firewall > Rules, select the new WireGuard interface tab:
- Click Add to create a new rule
- Set action to Pass
- Protocol: Any
- Source and Destination: Set both to Any for comprehensive connectivity
Save and apply changes.
Under Firewall > NAT > Outbound, select Hybrid mode, and ensure rules allow WireGuard outbound connections. Save and apply.
Setting Up Peer (Client) Connections
Under the WireGuard tunnel created earlier, click Add Peer:

Public Key: Obtain this from the client device after setup (see instructions below)
Allowed IPs: Typically, an IP range such as 10.0.0.2/32 for individual clients
Persistent Keepalive: Recommended setting: 25 seconds to maintain connectivity through firewalls and NAT

Interface Section:
- Generate a new private key (the client app will automatically provide a corresponding public key)
- Enter the client IP provided earlier (10.0.0.2/32, for example)
- DNS can be your preferred DNS or the pfSense DNS resolver's IP if you need DNS to come from pfSense
Peer Section:
- Endpoint: Enter the public IP or domain of your pfSense server and port (51820)
- Allowed IPs: Typically set to 0.0.0.0/0 to route all traffic through the VPN, or specific IP ranges as needed
- Public Key: Paste the public key generated from your pfSense WireGuard tunnel

All Categories

Matter & Thread Hub