Configuring WireGuard VPN Clients on OPNsense and pfSense for Third-Party VPN Providers

The increasing demand for secure and private internet access has led to the widespread adoption of Virtual Private Networks (VPNs). VPNs establish encrypted tunnels between a user's device and a remote server, thereby protecting data from interception and enhancing online anonymity. Common use cases include bypassing geographical restrictions, securing connections on public Wi-Fi networks, and improving overall online privacy. Among the various VPN protocols available, WireGuard has emerged as a modern and efficient solution. It offers significant advantages over traditional protocols like OpenVPN and IPsec, including stronger cryptography, higher speeds, and a more streamlined configuration process. Furthermore, its open-source nature and growing industry support have contributed to its increasing popularity. This article serves as a comprehensive guide for users seeking to configure WireGuard clients on OPNsense and pfSense firewalls to connect to popular third-party VPN providers such as NordVPN, Surfshark, and Mullvad. It will detail the necessary steps for each platform and provider, explain the fundamental configuration parameters, address potential issues users may encounter, and recommend best practices for security and optimization. This guide assumes that the user has a valid subscription with one of the aforementioned VPN providers.

Understanding WireGuard Configuration Basics

A WireGuard connection fundamentally involves two key components: the local interface and the remote peer. The Interface refers to the local WireGuard instance running on the OPNsense or pfSense firewall ¹. This instance is uniquely identified by a pair of cryptographic keys – a private key and a public key – and is assigned an internal IP address within the WireGuard tunnel network ¹. The Peer represents the remote WireGuard server provided by the VPN service ¹. To establish a secure connection, the local interface needs to know the remote peer's public key and its network endpoint, which consists of a public IP address or hostname and a UDP port ¹.

Several essential configuration parameters govern the establishment and operation of a WireGuard connection:

• Public Key: This serves as a unique identifier that is shared between the local interface and the remote peer, enabling secure communication ¹.
• Private Key: This is a secret key that remains only on the local device and is critical for encryption and decryption processes within the WireGuard tunnel ¹. Maintaining the confidentiality of the private key is paramount for the security of the WireGuard connection ¹. If compromised, unauthorized parties could potentially intercept and decrypt the user's traffic or even impersonate the user.
• Endpoint Address and Port: This specifies the public IP address or the publicly resolvable domain name of the VPN server, along with the UDP port it is listening on for WireGuard connections ¹.
• Allowed IPs: This parameter defines which network traffic should be routed through the VPN tunnel. A common setting is 0.0.0.0/0 for IPv4, which directs all IPv4 traffic through the tunnel ¹. Careful configuration of allowed IPs is essential to define the scope of the VPN connection. Incorrectly configured allowed IPs can lead to traffic unintentionally bypassing the VPN or, conversely, unintended traffic being routed through it.
• Tunnel Address: This is the internal IP address that is assigned to the WireGuard interface on the OPNsense or pfSense device ¹. On OPNsense, documentation emphasizes the need for this to be a unique private IP address and subnet for the network ¹. The tunnel address acts as the local endpoint of the virtual network interface, allowing the OPNsense or pfSense device to possess an IP address within the WireGuard network, which facilitates the routing of traffic into the tunnel.
• Listen Port: This is the UDP port on which the OPNsense or pfSense device listens for incoming WireGuard connection attempts, typically 51820 ¹. This port must be open on the firewall's WAN interface to permit the initial handshake from the VPN server. The VPN server will initiate its connection attempts by sending packets to this port.
• MTU (Maximum Transmission Unit): This parameter specifies the size of the largest packet that can be transmitted over the network ¹. Various sources suggest MTU values such as 1420 or 1412 for OPNsense ¹ and 1412 for pfSense ⁸. An incorrect MTU can lead to packet fragmentation, which increases overhead and can negatively impact performance or cause connection issues with certain VPN servers. If the MTU is set too high, packets might exceed the maximum size allowed by the network path and undergo fragmentation, leading to increased latency and potential reliability problems.
• DNS Servers: These are the IP addresses of DNS servers that the client should use when the VPN connection is active ¹. Configuring DNS servers provided by the VPN provider is crucial for preventing DNS leaks. If the system continues to use its default DNS servers while connected to the VPN, those requests might inadvertently reveal the user's actual IP address to their ISP or other third parties.
• Keepalive Interval: This optional parameter specifies the interval at which the local interface sends periodic packets to the remote peer to keep the connection alive, particularly useful when Network Address Translation (NAT) is involved ¹. A keepalive interval of 25 or 20 seconds is often recommended ⁵. This can help maintain a stable connection by preventing firewalls, especially NAT devices, from prematurely closing idle UDP connections. NAT devices might close UDP ports if they do not observe traffic for a certain period, and keepalive packets prevent this from happening.

Setting up WireGuard Client on OPNsense with Third-Party VPN Providers

General Steps for OPNsense

The process of setting up a WireGuard client on OPNsense involves several key steps. First, if using an older version of OPNsense, it might be necessary to install the WireGuard plugin. This can be done by navigating to System > Firmware > Plugins and searching for os-wireguard, then clicking the install icon ⁴. However, it's important to note that WireGuard has been integrated into the core of OPNsense since version 20.1, so this step might not be required for newer installations ¹⁴.

Next, a new WireGuard instance needs to be created under VPN > WireGuard > Instances ¹. This involves providing a descriptive name, generating or manually entering the private and public keys for the OPNsense device, specifying the listen port (typically 51820 or a higher unique port), and configuring the tunnel address with a unique private IP and subnet ¹.

After creating the instance, a new WireGuard endpoint needs to be added under VPN > WireGuard > Peers (or Endpoints in some versions) ⁵. This configuration requires entering the public key of the VPN server, its endpoint address (IP address or hostname) and port (usually 51820), and the allowed IPs, which are often set to 0.0.0.0/0 to route all traffic through the VPN ⁵.

The WireGuard instance then needs to be assigned to a network interface. This is done under Interfaces > Assignments by adding a new interface and selecting the newly created WireGuard instance ⁴. After adding the interface, it needs to be enabled, and it might be necessary to configure the MTU and MSS values ⁵.

To ensure that traffic from the local network goes through the VPN tunnel, outbound NAT rules need to be configured under Firewall > NAT > Outbound ⁵. This typically involves switching to "Hybrid" outbound NAT rule generation and creating a new rule that specifies the LAN network as the source and the WireGuard interface as the interface for translation.

Firewall rules are also crucial to allow traffic to pass through the VPN tunnel. These rules are configured under Firewall > Rules ⁵. Rules need to be added to the WireGuard interface to allow traffic to pass, and potentially rules on the LAN interface to direct specific traffic to the VPN.

Finally, to prevent DNS leaks, it's important to configure DNS settings. This is usually done under System > Settings > General by setting the DNS servers to those provided by the VPN provider and potentially setting the gateway to the WireGuard interface ⁵. It is generally recommended to leave the DNS Server field blank in the WireGuard instance configuration to avoid overwriting OPNsense's global DNS settings ¹. Some guides might suggest configuring the DNS server directly on the client side within the WireGuard configuration file if available.

Specific Instructions for NordVPN on OPNsense

Setting up NordVPN with WireGuard on OPNsense requires obtaining specific configuration details from NordVPN. Unlike some other providers, NordVPN might not directly provide WireGuard configuration files for routers ¹⁰. Users often need to manually retrieve server addresses and public keys, sometimes through their NordVPN account dashboard or by using their API ¹⁰. NordVPN utilizes a custom WireGuard implementation called NordLynx, which might necessitate a slightly different approach compared to generic WireGuard setups ¹⁰.

The general steps for OPNsense would still apply. Users would create a new WireGuard instance, generating their own private and public keys. Then, they would add a new peer (endpoint) using the NordVPN server's public key and endpoint address (IP or hostname and port, typically 51820 for WireGuard) obtained from NordVPN ¹⁰. The "Allowed IPs" for the peer should be set to 0.0.0.0/0 to route all traffic through the VPN. The tunnel address for the OPNsense instance would be a private IP address within a suitable range. After configuring the WireGuard interface and enabling it, users would need to set up outbound NAT rules for their LAN to use the WireGuard interface and create firewall rules to allow traffic. Configuring DNS servers provided by NordVPN in OPNsense's general settings is crucial to prevent leaks ¹⁹. Some users have reported that obtaining the NordLynx server details might involve using the NordVPN client on a Linux system to extract the necessary information ¹⁰.

Specific Instructions for Surfshark on OPNsense

Configuring Surfshark with WireGuard on OPNsense is generally more straightforward as Surfshark provides a mechanism to generate WireGuard credentials specifically for router configuration ⁷. Users can log into their Surfshark account, navigate to the manual setup section, and choose the router option, then WireGuard ⁷. Here, they can either upload their own public key or have Surfshark generate a new key pair ⁷. Surfshark often provides a configuration file or the necessary details such as the server IP address or hostname, public key, private key, and allowed IPs (typically 0.0.0.0/0) ⁷.

Using these details, users would follow the general OPNsense WireGuard setup steps. They would create a new instance, entering the private key provided by Surfshark and choosing a listen port. The tunnel address is often specified in the Surfshark configuration details. Then, they would add a peer using the Surfshark server's public key, endpoint address and port (usually 51820), and set allowed IPs to 0.0.0.0/0 ⁷. The subsequent steps of assigning the interface, configuring NAT, and setting up firewall rules would follow the standard OPNsense procedure. It is also important to configure Surfshark's DNS servers in OPNsense's general settings to ensure DNS leak protection ⁷.

Specific Instructions for Mullvad on OPNsense

Setting up Mullvad with WireGuard on OPNsense involves utilizing the Mullvad API to retrieve certain configuration details ¹⁵. Users first need to create a WireGuard instance in OPNsense under VPN > WireGuard > Instances, giving it a name and setting a listen port. They should also note down the automatically generated public key for this instance ¹⁵.

Next, users need to access the OPNsense command-line interface (via SSH or console) and execute a curl command provided by Mullvad ¹⁵. This command requires replacing placeholders with the user's Mullvad account number and the public key noted in the previous step. The command interacts with the Mullvad API and returns the allowed IP addresses (tunnel address) for the WireGuard instance ¹⁵. This returned IP address needs to be updated in the tunnel address field of the WireGuard instance configuration in the OPNsense web interface ¹⁵.

After this, users need to navigate to Mullvad's server list on their website, filter for WireGuard servers, and choose a server they wish to connect to ¹⁵. They need to note down the server's public key and endpoint address (hostname and port, which is usually 51820) ¹⁵. This information is then used to create a new peer under VPN > WireGuard > Peers, setting the allowed IPs to 0.0.0.0/0 ¹⁵. Finally, the newly created peer needs to be selected in the peers dropdown within the WireGuard instance configuration ¹⁵. The remaining steps involve enabling WireGuard in the general settings, assigning the interface, configuring NAT, and setting up firewall rules as per the general OPNsense procedure. Mullvad also provides specific DNS server addresses that should be configured in OPNsense to prevent DNS leaks ¹⁵.

Setting up WireGuard Client on pfSense with Third-Party VPN Providers

General Steps for pfSense

Configuring a WireGuard client on pfSense starts with installing the WireGuard package. This can be done by navigating to System > Package Manager > Available Packages, searching for "wireguard", and clicking the install button ².

Once the package is installed, a new WireGuard tunnel needs to be added under VPN > WireGuard > Tunnels ². This involves enabling the tunnel, providing a description, and generating or entering the interface keys (private and public) for the pfSense device. The tunnel address, which is the internal IP address for the pfSense WireGuard interface, is also configured here.

Next, a new WireGuard peer needs to be added within the settings of the newly created tunnel ³. This requires entering the public key of the VPN server, its endpoint address (IP address or hostname) and port (typically 51820), and the allowed IPs, which are often set to 0.0.0.0/0 to route all traffic through the VPN.

The WireGuard tunnel then needs to be assigned to a network interface. This is done under Interfaces > Assignments by adding a new interface (usually tun_wg0) ². After adding the interface, it needs to be enabled. The IPv4 Configuration Type should be set to "Static IPv4", and the IPv4 Address should be the same as the tunnel address configured earlier ⁸. It might also be necessary to configure the MTU and MSS values ⁵.

To ensure that traffic from the local network goes through the VPN tunnel, outbound NAT rules need to be configured under Firewall > NAT > Outbound ⁵. This typically involves selecting "Manual Outbound NAT rule generation" and creating new rules that specify the LAN network as the source and the WireGuard interface as the interface for translation.

Firewall rules are also crucial to allow traffic to pass through the VPN tunnel. These rules are configured under Firewall > Rules ². Rules need to be added to the LAN interface to direct traffic to the VPN gateway, and potentially a rule on the WireGuard interface itself. Floating rules can also be used to create a kill switch ².

Finally, to prevent DNS leaks, it's important to configure DNS settings under System > General Setup > DNS by setting the DNS servers to those provided by the VPN provider and setting the gateway to the WireGuard interface ². It might also be necessary to configure the DNS servers in the DHCP server settings under Services > DHCP Server ².

Specific Instructions for NordVPN on pfSense

Currently, direct setup of NordVPN's NordLynx protocol using the WireGuard client on pfSense might not be fully supported ¹⁰. Some sources suggest that the NordLynx protocol is primarily available through NordVPN's dedicated applications ²¹. Therefore, setting up NordVPN on pfSense might involve manually configuring the WireGuard client using server details obtained from NordVPN or considering the use of the OpenVPN protocol instead ²¹.

If proceeding with manual WireGuard configuration, users would follow the general pfSense WireGuard client setup steps. This would involve installing the WireGuard package, adding a new tunnel and generating interface keys. Then, a new peer would be added using the NordVPN server's public key and endpoint address (IP or hostname and port) which would need to be obtained from NordVPN's resources. The allowed IPs would typically be set to 0.0.0.0/0. The WireGuard tunnel would then be assigned to an interface with a static IP address. Outbound NAT and firewall rules would need to be configured to route traffic through the VPN. Finally, NordVPN's DNS servers should be configured in pfSense's general settings to prevent DNS leaks.

Specific Instructions for Surfshark on pfSense

Setting up Surfshark with WireGuard on pfSense is similar to the process on OPNsense. Surfshark provides the necessary configuration details for manual setup on routers ². Users can typically find these details by logging into their Surfshark account and navigating to the manual setup section ³².

Using the provided information, users would follow the general pfSense WireGuard client setup steps. This includes installing the WireGuard package, adding a new tunnel and generating or entering interface keys. Then, a new peer would be added using the Surfshark server's public key, endpoint address and port (usually 51820), and the allowed IPs set to 0.0.0.0/0 ⁹. The WireGuard tunnel would then be assigned to an interface with a static IP address. Outbound NAT and firewall rules would need to be configured to route traffic through the VPN. It is also crucial to configure Surfshark's DNS servers in pfSense's general settings to ensure DNS leak protection ⁹. Some users have reported successfully using general pfSense WireGuard setup guides with Surfshark by utilizing the configuration files provided by Surfshark ⁹.

Specific Instructions for Mullvad on pfSense

Configuring Mullvad with WireGuard on pfSense mirrors the process on OPNsense, involving the use of the Mullvad API ¹². Users first need to install the WireGuard package on pfSense. Then, they need to log in to the pfSense device via SSH to generate WireGuard keys using the wg genkey command and retrieve their assigned IP address using a curl command that interacts with the Mullvad API ¹². This command requires the user's Mullvad account number and the generated public key ¹².

After obtaining the IP address, users need to log in to the pfSense web interface and navigate to VPN > WireGuard > + Add Tunnel ¹². Here, they provide a description, enter their private key, and the IP address obtained from the API as the interface address. Next, they edit the tunnel and add a new peer, entering the details of the Mullvad server they wish to connect to, including its public key, endpoint address and port (usually 51820), and setting allowed IPs to 0.0.0.0/0 ¹². The WireGuard tunnel is then assigned to an interface under Interfaces > Assignments, configured with the IP address obtained from the API ¹². Finally, outbound NAT and firewall rules are configured to route traffic through the VPN, and Mullvad's DNS servers (e.g., 10.64.0.1) are set up in pfSense's general settings to prevent DNS leaks ¹².

Common Configuration Parameters Explained

To ensure a successful WireGuard VPN connection, a thorough understanding of the essential configuration parameters is necessary. The Endpoint Address specifies the public-facing IP address or hostname of the VPN server that the client will connect to. This is crucial for the initial connection establishment ¹. The Public Key acts as the identifier for the VPN server, allowing the client to verify its authenticity and establish a secure encrypted channel ¹. Conversely, the Private Key is unique to the client device (OPNsense or pfSense) and must be kept secret. It is used for encrypting outgoing traffic and decrypting incoming traffic ¹. The Allowed IPs parameter on the client dictates which destination IP addresses or networks should have their traffic routed through the VPN tunnel. Setting this to 0.0.0.0/0 effectively forces all internet-bound traffic to go through the VPN ¹. The Tunnel Address is the internal IP address assigned to the WireGuard interface on the firewall itself. This IP address is part of a virtual private network created by the WireGuard tunnel ¹. The Listen Port is the UDP port on the firewall that listens for incoming WireGuard connection attempts from the VPN server, with 51820 being the default ¹. The MTU defines the largest size of a packet that can be transmitted without fragmentation. Incorrect MTU values can lead to performance degradation ¹. DNS Servers specify the IP addresses of the DNS servers that the client should use when the VPN is active. Using the VPN provider's DNS servers helps prevent DNS leaks ¹. Finally, the Keepalive Interval sends periodic small packets to maintain the connection, especially useful when NAT is involved ¹.

Correctly configuring each of these parameters is paramount for establishing a functional and secure VPN connection. Even a minor error in any of these settings can prevent the connection from being established or can lead to unexpected behavior, such as traffic not being routed correctly or DNS leaks. Therefore, it is essential to obtain accurate configuration details from the chosen VPN provider and to double-check each parameter during the setup process.

Troubleshooting Common Issues and Their Solutions

Users might encounter various issues during the WireGuard setup process. One common problem is connection failure or handshake issues ¹³. To troubleshoot this, it's crucial to check the firewall rules on both the OPNsense/pfSense device and potentially on the VPN server's side if applicable ¹³. Verifying that the endpoint address and port of the VPN server are entered correctly is also essential ¹³. Ensure that the public keys for both the client and the server are exchanged and entered accurately in their respective configurations ¹³. Examining the WireGuard status logs for any specific error messages can provide valuable clues ¹³. Sometimes, simply restarting the WireGuard service or even the entire firewall can resolve temporary glitches ³⁶. In cases where dynamic DNS is used for the VPN server's endpoint, there might be issues with the DNS not resolving correctly at boot time ³⁸. A potential workaround is to disable and then re-enable the WireGuard connection after the system has fully booted or to set up a cron job to periodically re-resolve the DNS address ³⁸.

Another prevalent issue is DNS leaks, where DNS requests are not routed through the VPN, potentially revealing the user's actual IP address ⁵. To prevent this, it's vital to configure the DNS servers provided by the VPN provider in the OPNsense/pfSense general settings or within the DHCP server settings ⁵. It's also important to ensure that the gateway for these DNS servers is set to the WireGuard interface ⁵. Users should also check for and uncheck any options that might override these DNS settings ⁹.

Routing problems, where internet traffic does not seem to be going through the VPN tunnel, are also common ². This often stems from incorrect outbound NAT rules. Users need to ensure that they have configured NAT rules that specify the WireGuard interface as the interface for traffic originating from their local network that should be going through the VPN ⁵. Additionally, firewall rules on the LAN interface must be in place to direct this traffic to the WireGuard gateway ⁵. For users who want only specific traffic to go through the VPN, policy-based routing might need to be configured ⁵. In some cases, a static route to the VPN endpoint's IP address via the WAN gateway might be necessary to avoid routing loops ². Incorrectly configured "Allowed IPs" on either the client or the server side can also lead to routing issues ³⁹.

MTU/MSS issues can manifest as slow speeds, inability to load certain websites, or general connection instability ¹. Experimenting with different MTU values in the WireGuard instance/tunnel settings (e.g., trying 1420 or 1412) and setting the MSS on the LAN interface to a slightly lower value (e.g., 1412 or 1380) can often resolve these problems by preventing packet fragmentation ¹. Some users have also found that configuring normalization rules on the WireGuard interface can be helpful ³⁶.

Firewall rule misconfigurations are a frequent cause of VPN connection problems ². It's crucial to ensure that a firewall rule exists on the WAN interface to allow UDP traffic on the WireGuard listen port (usually 51820) ¹⁷. Additionally, rules on the internal interfaces (LAN and the WireGuard interface itself) need to be configured to permit traffic to pass as intended ⁵. The order of firewall rules can also be important, as rules are typically evaluated from top to bottom ⁷.

Finally, users employing dynamic IP addresses (DynDNS) for their OPNsense or pfSense device might encounter issues where the WireGuard connection fails to establish after a reboot ³⁸. This can occur if the dynamic DNS record has not been fully updated by the time the WireGuard service attempts to start. A potential solution involves disabling and then re-enabling the WireGuard service after the system has booted, or implementing a scheduled task (cron job) to re-resolve the DNS address after a delay ³⁸.

Best Practices for Securing and Optimizing WireGuard VPN Connections

To maximize the security and performance of WireGuard VPN connections on OPNsense and pfSense, several best practices should be followed. Implementing strong firewall rules is essential. Only necessary traffic should be allowed to pass through the VPN interface, adhering to the principle of least privilege. Firewall rules should be configured to block any potentially malicious or unwanted traffic ³.

Proper routing configurations are also crucial. Policy-based routing should be utilized to ensure that only the intended traffic is directed through the VPN tunnel, while other traffic uses the regular internet connection ⁵. This allows for selective VPN usage, where only specific devices or applications have their traffic routed through the VPN.

Employing a kill switch mechanism is a vital security measure. This can be achieved by configuring floating firewall rules to block all traffic from the LAN that is supposed to go through the VPN if the VPN connection unexpectedly drops. This prevents accidental exposure of the user's real IP address ⁷.

It is imperative to regularly update both the OPNsense or pfSense firewall software and the WireGuard package or plugin ³¹. These updates often include critical security patches and performance improvements, ensuring the overall robustness and security of the VPN connection.

Finally, consider performance optimization techniques. Experimenting with different MTU and MSS values can help find the optimal settings for the specific network and VPN provider, potentially improving speed and reducing latency ¹. Techniques like MSS clamping can also be explored. It's worth noting that there might be performance differences between the WireGuard implementations on OPNsense and pfSense ⁴¹. On pfSense Plus, enabling hardware offloading features might further enhance performance ⁴³.

Verifying the WireGuard VPN Connection

After configuring the WireGuard VPN connection, it's important to verify that it is functioning correctly. The status of the connection can be checked in the OPNsense or pfSense web interface by navigating to VPN > WireGuard > Status ¹. This page typically displays the tunnel status, the connectivity status of the peer (indicating if a handshake has been successful), and the amount of data transferred ⁵.

Command-line tools can also be used to verify the connection. The ping command can be used to test connectivity to resources on the VPN network or to external internet addresses ¹³. The traceroute command can help visualize the path that network traffic is taking, allowing users to confirm that it is indeed going through the VPN tunnel ¹³. The wg show command, executed via SSH on the OPNsense or pfSense device, provides detailed information about the WireGuard interface and any active connections ⁶.

One of the most crucial verification steps is to check the public IP address and the DNS server being used. This can be done by visiting websites like ifconfig.co ² or whatismyip.com. The displayed IP address should match the IP address of the VPN server's location, confirming that traffic is exiting through the VPN. Additionally, performing a DNS leak test using dedicated websites (e.g., dnsleaktest.com ⁵, Mullvad's check page ¹⁶) is essential to ensure that DNS requests are being routed through the VPN provider's servers and that the user's real IP address is not being leaked ⁵.

Conclusion

Setting up WireGuard VPN clients on OPNsense and pfSense to connect to third-party providers like NordVPN, Surfshark, and Mullvad requires careful attention to detail and a thorough understanding of the underlying configuration parameters. This guide has provided a comprehensive overview of the necessary steps for each platform and provider, along with explanations of common issues and best practices for security and optimization. By following these instructions and diligently verifying the connection, users can establish secure and efficient VPN tunnels to protect their online privacy and security. The inherent speed and modern cryptography of the WireGuard protocol make it an excellent choice for users seeking a robust and high-performing VPN solution on their OPNsense or pfSense firewalls.

Check https://opnsense-wg.x88.in/ for a more straightforward approach.