Hi Friends - Looks like with a recent OPNsense update, they now require you to enter both the WireGuard private & public key into the local config. In the video, I only show entering the private key - since this was all that was required at the time. Two ways to get your public key: 1. Log into Mullvad & check the "Devices" tab under "Account Management". This will show your device public key (They don't keep your private key after generating it for you, only the public). 2. If you have wireguard installed somewhere else, you can use the "wg pubkey" command to derive a public key from your private key. Command: echo | wg pubkey
@tuhruce
11 ай бұрын
HI, im on opnsense with wireguard plugin but there doesn't seem to be a status or handshakes tab for me?
@0x2142
11 ай бұрын
Hey there - With the recent updates, this information has moved under VPN > WireGuard > Diagnostics, and is no longer under the WireGuard > Settings page.
@coletraintechgames2932
11 ай бұрын
Also, when you do Mullvad Config generator "Step 2 - Generate a Wireguard Key" there is a bar under it that can be expanded that says "Manage Wireguard Keys" Where you can get it.
@d0shie
9 ай бұрын
FYI, the old implementation is still available using the os-wireguard-go plugin. Prior to the aforementioned update, it essentially shared the same source code with the os-wireguard kernel implementation. While the Go implementation is considered deprecated, it's perfectly usable all the same should you choose to stick with it.
@attackhelicopter-up3dh
8 ай бұрын
Dont nat the traffic on the wireguard group but on the interface of the tunnel itself, when you nat on the wireguard group things get f*cked up when you add more tunnels. It Will not work.
@kodemasterx
11 ай бұрын
Awesome tutorial, please do more OPNsense related tutorials as not many ppl do.
@0x2142
11 ай бұрын
Thanks so much for the comment! It's certainly my most popular content so far 😊 I am always open to suggestions / requests if you have any!
@PoseidonMade
11 ай бұрын
Best tutorial for this that I've found online yet, thank you so much!
@0x2142
11 ай бұрын
Thank you so much!! ☺️
@MountainJack28
7 ай бұрын
These guides are not working with the new update. I don't know what it is.
@kazumakazuma5814
20 күн бұрын
This tutorial has helped me out a lot. Thank you!
@0x2142
17 күн бұрын
Glad to hear it! 😊
@stacksmasher
6 күн бұрын
This video is amazing. Could you please show a tutorial for split tunneling with Mullvad from the CLI?
@avpr1c
8 ай бұрын
This video helps a lot. Nice work
@illum1n4ti
2 ай бұрын
Networking Nonsense could u please update this guide? this guide is not working after update 24.1.8 PLEASE :(
@188D1
4 ай бұрын
I had to enable "Disable Routes" at the Wireguard instance (8:28) + create a Gateway and set it in LAN rule for it to work
@erbmur
4 ай бұрын
Are you able to get web browsing to work? I also put this in place, but am not able to access the web.
@188D1
4 ай бұрын
@@erbmur yes this is what is did: 0. configure exactly like in the video 1. VPN -> Settings -> Instances: Enable "disable rules" 2. Interfaces -> Assignments: create interface "mullvad" 2.1 Interfaces -> [mullvad]: Enable Inteface 3. System -> Gateways -> Configuration -> add Gateway: 3.1 Interface: mullvad 3.2 IP Address: Wireguard Tunnel Address -1 (dont ask me why) 3.3 Enable far gateway 4. Firewall -> NAT -> Outbound -> edit NAT rule: 4.1 Interface: mullvad 4.2 NAT address: Wireguard Tunnel Address 5. Firewall -> Rules -> LAN: edit rule 5.1 Gateway: mullvad Gateway Notes: 1. check if public key is in the Wireguard instance is missing - you might have to calc & add it yourself 2. you have to use the mullvad dns
2 ай бұрын
Would be great if you can make a guide for wireguard selective routing to Warp+, use wgcf to get config file. The trick to get warp+ is to sub on the phone, grab the lic key -> wgcf register -> change lic - wgcf update -> wgcf generate.
@cyberwatchdogs
13 сағат бұрын
Is it safe to have a floating rule to allow Mullvad traffic IN ?
@capps1994
5 ай бұрын
I have just got an applience to act as my firewall but it looks like there has been some major changes behind the sences in OPNsense, I have tried many things to get this to route over this VPN, the only results I have got have been SSL errors when browsing to sites, it seems to use the whole firewall as a proxy, or nothing as in no internat or it would still route over my main lan. I know that this is not your fault, your tutorital was the best it got me this far to getting this to work.
@erbmur
4 ай бұрын
I'm in the same boat. Have you been able to find a solution to getting it to work?
@silverismoney
4 ай бұрын
Hi. Cool tutorial. The interface looks a bit different now as i'm sure you know. I have a question though. I have multiple WAN links (5G, DSL) and I'm wondering, If I set my LAN to use my wireguard VPN .. which link is it going to use ? because right now, I have some clients like streaming TV stuff going over 5G but important stuff for work going over my DSL. I want all traffic to be full tunnel to the VPN but i also want them to go via different WAN links. Do you have any advice on that ?
@silverismoney
4 ай бұрын
im being stupid aren't I. I'll need two VPNs.
@0x2142
4 ай бұрын
So by default, the tunnel is going to use whichever link it can to get to the VPN peer address. So if your default route is over the 5G, it would likely use that. If you wanted all traffic to be tunneled & still maintain that traffic separation, you would likely need two VPN Tunnels. I haven't done this myself, but you could probably add static or policy routes for each of the VPN peer addresses - pointing one over each uplink. Then use the policy routing from the LAN to direct traffic over whichever tunnel from there.
@silverismoney
4 ай бұрын
@@0x2142 hey thanks man. I figured something similar too with policy based routing.
@clumsyzombie4932
6 ай бұрын
What i would like to see is setting up multi WAN connections with OPNSense So my fiber at home goes down then my T-Mobile Home Internet plugged into another connection can keep us online till fiber comes back online since I work Full time Work From home it would be nice to see something like that or atlest away to go in and disable one and enable the other if needed but auto fail over would be cool also. Great Videos I have been following and enabling all kind of stuff. Thank you so much
@0x2142
6 ай бұрын
Hey there! Thanks for the comment!! I actually have this set up at home right now since I am also full time remote / WFH. So I have mine set up to automatically fail over if my primary provider starts having issues (which unfortunately is often). I can start putting something together on how to do this!
@clumsyzombie4932
6 ай бұрын
@@0x2142 That would be awesome. I have been toying with OPNSense on a Optieplex I had laying around and got 1 2port card and a 4 port card in it and built a test networking out of it. I do not feel good about replacing my home Dream router yet till I understand it a bit more. but with a 256SSd and 8 GB ram and 4 core intel proc I know might be a bit over kill but what I had and it is working. Just trying to make sure i get the rules setup correct before i down the 3 or 4 game servers I am hosting and tick a ton of people off.
@emanbuoy4218
5 ай бұрын
can you do this exact tutorial but with PIA vpn please?
@Bobnotfalnn
9 ай бұрын
Thank you so much!! this took me 1 month to understand what you were doing, now i fell like i understand opnsense better. One question i was able to set up so that in the firewall:Rules: Floating to route an entire vlan that i use to the wireguard and it worked, the problem is that i want to access my internal services too that are in another vlan, is it possible to set up something like mylan->serverlan->wireguard?
@attackhelicopter-up3dh
7 ай бұрын
Remove floating rule,make an alias called rfc ranges. go to your firewall/rules/your vlan Create a rule pass Source: your vlan net Destination: rfcranges Gateway: default Create another rule: Pass Source: your vlan net Destination: rfcranges INVERT! Gateway: force Gateway of your vpn
@TangDynasty1983
10 ай бұрын
I followed your video a year ago and set up OPNsense as a Wireguard VPN server so I can connect my laptop to my home network when I'm outside. If I want to follow this video and create another WG instance to route all my traffic (including my home traffic and my laptop traffice from outside) through Mullvad. Is that even possible? If so, what's the proper way to set it up? Thanks a lot!
@0x2142
10 ай бұрын
Yeah absolutely that's possible. While I was recording this video, I actually had that configuration running at home. You'll want to separate out the local configuration on OPNsense into two sets, one for the Mullvad peers and one for your other VPN. I would also recommend then setting up each OPNsense WireGuard tunnel interface with it's own interface assignment (shown in the policy routing section of the video). This will allow you to have separate firewall rules under each WG interface, instead of using the WireGuard (group) set. If you want your normal WireGuard VPN clients to use Mullvad as well, just keep in mind you may also need to create a NAT rule.
@TangDynasty1983
10 ай бұрын
@@0x2142Is it possible if you can make another video for that? In this video I only see one WG instance instead of two. I'm also confused about the NAT rule as well, if we have two WG interfaces, why do we need to use NAT? What's the purpose of NAT in this case? Sorry I'm new to this.
@TangDynasty1983
10 ай бұрын
@@0x2142for Endpoint port, I should input a different number than 51820, right? If I have two separate instances.
@egit2427
11 ай бұрын
Really love the tutorial. However, I have a challenge. I appear to be using a newer version of opnsense, 23.7.4, and my local config is requiring a public and private key pair. Any ideas as this has me stumped?
@0x2142
11 ай бұрын
Ahh - Yeah this is the fun with making videos on tech... Stuff changes! Okay, so I updated my instance to 23.7.4 and I see the same thing - the public key is required. Two ways to address this: 1. Log into Mullvad & check the "Devices" tab under "Account Management". This will show your device public key (They don't keep your private key after generating it for you, only the public). 2. If you have wireguard installed somewhere else, you can use the "wg pubkey" command to derive a public key from your private key. Command: echo | wg pubkey
@capps1994
5 ай бұрын
Are you also TheDuelLogs, your voices sound very similar 😂
@DirkTas
7 ай бұрын
Hello, very interesting video's about OPNsense and wireguard, I have now seen the OPNsense to client, the OPNsense to OPNsense and this one the wireguard VPN. In all these video's you use the same port for wireguard - 51820, but what if you want to have all of this at the same time, can I use the same port or do I need to use a different port for the different wireguard instances?
@0x2142
7 ай бұрын
Hi there, yeah you can run this all at the same time but would just need to use a different port depending on how you ran it. So it's one port per instance of wireguard. On my firewall at home, I run two instances - one for remote VPN and one for site to site - when then use 51820 and 51821. You could probably add all of the clients into one instance - but it's easier to manage firewall rules, etc if they're separate.
@Michael-rq8zj
11 ай бұрын
What's the difference between using this and wireguard?
@0x2142
11 ай бұрын
Hi there - More or less it's the same. Mullvad is just a cloud-hosted VPN provider, and they offer VPN via OpenVPN and WireGuard. So in the video, we configure & use WireGuard to connect to them. With Mullvad, you're encrypting your traffic over a WireGuard tunnel to one of their datacenters - which is them routed out to the internet. Alternatively if you configured a WireGuard server at home - then you could use it to connect remote clients to resources on your home network.
Пікірлер: 56