pfSense WireGuard VPN Setup Guide

Install WireGuard Package

# Go to pfSense Web UI
System → Package Manager → Available Packages

# Search and install
wireguard
wireguard-tools

Create WireGuard Tunnel (Server)

# Navigate
VPN → WireGuard → Tunnels → Add

# Enable tunnel
Enable: ✔

# Generate keys
Click "Generate"

# Configure
Listen Port: 51820
Tunnel Address: 10.10.0.1/24

Add Peer (Client)

# Navigate
VPN → WireGuard → Peers → Add

# Add client details
Description: client1
Public Key: CLIENT_PUBLIC_KEY
Allowed IPs: 10.10.0.2/32
PersistentKeepalive: 25

Assign WireGuard Interface

# Navigate
Interfaces → Assignments

# Add new interface
Select WireGuard → Add

# Enable interface
Enable ✔
Name: WG

Allow WireGuard on WAN

# Navigate
Firewall → Rules → WAN

# Add rule
Action: Pass
Protocol: UDP
Port: 51820
Source: Any
Destination: WAN Address

Allow VPN Traffic

# Navigate
Firewall → Rules → WG

# Allow all traffic from VPN
Action: Pass
Source: WG net
Destination: Any

Configure NAT (Internet Access)

# Navigate
Firewall → NAT → Outbound

# Switch mode
Hybrid Outbound NAT

# Add rule
Interface: WAN
Source: 10.10.0.0/24
Translation: Interface address

Client Configuration

# Example client config (phone/PC)

[Interface]
PrivateKey = CLIENT_PRIVATE_KEY
Address = 10.10.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = YOUR_PUBLIC_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Enable WireGuard

# Navigate
VPN → WireGuard → Settings

# Enable service
Enable WireGuard ✔

# Save and apply
Save

Test VPN Connection

# From client
ping 10.10.0.1

# Test internet
open browser → google.com

Common Issues

# No handshake
Check WAN port 51820 open

# Connected but no internet
Check NAT rule

# Can't access LAN
Add firewall rule:
WG net → LAN net

# Behind ISP router
Forward UDP 51820 to pfSense

Installation

Server Setup

Interface

Firewall

Networking

Client

Service

Testing

Troubleshooting