This was a great tutorial, thanks a lot! For people with newer versions of Opnsense (Apr 2024), there are a few main differences: - There will be two wireguard plugins, use os-wireguard, not os-wireguard-go *. - "Local" tab is now called "Instances" tab - "Endpoints" tab is now called "Peers" tab - On the "Edit Instance" form, you will need to click the cog to generate the keypair. It does not auto-generate on save anymore as described in the video. Everything else is exactly the same (fields, buttons, configurations, etc); just follow the video. --- * As of October 2023, the "go" version is on a deprecation path and the code is being moved to the kernel version. According to Franco (core maintainer of Opnsense): "[...] the wireguard and wireguard-go plugins are no longer the same code base with go variant being old and deprecated [...]"
@0x2142
4 ай бұрын
Thanks so much for sharing the updates & differences between versions!
@RomainQ
2 ай бұрын
oof that "add isntance" button was hard to find
@MDalton10
2 жыл бұрын
Wow. After messing with this for hours this video explained it all in 20 minutes. Thanks!
@KrisRosson
3 ай бұрын
I agree with the rest of the comments. This is hands down the best video and explanation of setting up wireguard on OPNsense FW that I have ever seen. Thank you for taking the time to not only show us how to do the setup, but you explain why we set the things we need to and what the ramifications are. Thank you.
@franklincerpico7702
Жыл бұрын
HOLY CRAP, this is by far the best tutorial on how to setup Wireguard on Opnsense ever. You're the man.
@0x2142
Жыл бұрын
Thanks so much for saying so! 😊 Glad it was helpful!!
@albertbardewyck1678
2 ай бұрын
@@0x2142 I can confirm that. I followed German instructions, none were as understandable as yours, thank you
@paulrolf1795
7 ай бұрын
Nearly gave up trying to set WireGuard up on my OPNsense box. Watched your video and hey presto - connected straight away. Thank you so much!!!
@chrisboxsell4981
3 ай бұрын
You're going to go ahead and go ahead real quick real quick because you went ahead.
@Vegetableswithpants
Жыл бұрын
This video just helped me finally get WireGuard set up properly! I just started learning basic Linux and networking stuff about two weeks ago, and this was one of my goals - to set up my own VPN and cancel my SurfShark subscription. Thanks for the support in reaching this goal :)
@0x2142
Жыл бұрын
Awesome! Glad to hear it helped & good luck with learning the new skills! Both of those topics are a lot of fun 😊
@furikura
Жыл бұрын
the best video. you're the only one that provides a short description of what each config field means in a practical sense, as well as the different results of different settings you could use. much better than blindly following someone's config, which leads to difficulties troubleshooting being a non-network person
@0x2142
Жыл бұрын
Thank you so much! I really appreciate your comment & glad it was helpful!! ☺️
@misc_projects
7 ай бұрын
I completely agree. This is the most direct and informative tutorial I've seen after watching many other. It even worked on v23, just a few menu differences in the wireguard config tabs.
@bilinz
2 жыл бұрын
Just wanted to say I tried this a few times and each time couldn't get it to work. Your video was so clear and concise I got it working on the first shot. Subscribed!
@0x2142
2 жыл бұрын
Awesome! Glad to hear it helped!!! 😊
@bilinz
2 жыл бұрын
@@0x2142 would love to see more content on OPNsense. It's pretty lacking on KZitem compared to pfsense
@0x2142
2 жыл бұрын
Thanks for the feedback 👍. I've been debating doing more - if you have any specific requests or suggestions, I'm open to ideas!
@bilinz
2 жыл бұрын
@@0x2142 maybe a video on setting up unbound with Adguard?
@SysTek2000
9 ай бұрын
Thank you so much for the video! All of this still works, the only difference is now in OPNSense v23.7.7_3 the WireGuard tabs are "Instances" instead of "local" and "Peers" instead of "Endpoints".
@haydenc2742
Жыл бұрын
Amazing!!! Was beating my head on the desk trying to figure out how to configure wireguard on OPNsense...your video had me doing it in minutes!!!!!
@brandonwisenburg8899
Жыл бұрын
I had been trying to get WireGuard setup on my new install of opensense and it had been awhile since I had done it before. This video nailed it. Thanks.
@mylesmacaulay
Жыл бұрын
Such a well done video. So well explained. Good job! I'm up and running!
@bahadirm
2 жыл бұрын
Nice, you uploaded this video just as I wanted to setup WireGuard instead of OpenVPN.
@0x2142
2 жыл бұрын
Haha - Great timing, huh? 😊 Good luck with the setup!!
@bahadirm
2 жыл бұрын
@@0x2142 Works flawless now, even on my phone. With OpenVPN I couldn't get internal hostnames to work on Android.
@zinkzxd2891
Жыл бұрын
Thank you bro, was getting mixed up on where the public keys went and this video sorted that out.
@lequack7130
Жыл бұрын
Thank you very much for the tutorial, took me a moment but i did manage to connect to my PureVPN provider. Have a nice day!
@zachtarr6291
Жыл бұрын
Thank you so much for this! I was struggling to get Wireguard working properly but this explained everything I was missing.
@an_birb
2 жыл бұрын
I like the way you graph things :)
@unklfrsh6447
Жыл бұрын
This was the info I needed. Everything is working now. Thank you :)
@gamer1xbox360
10 ай бұрын
Wow awesome video! Nice way to explain quickly what we want to achieve with effective and to the point instructions.
@andyalias
9 ай бұрын
OPNSense is similar to PFSense so was able to get up and running, Thanks
@Tntdruid
Жыл бұрын
Thanks for the very nice guide. Got it working now 👍
@scottgray6099
7 ай бұрын
Just looking to set this up and came across this video. Main differences: There are two packages available to install - Wireguard and Wireguard GO. Installed the first only to get a warning that the software was deprecated and due to be discontinued after 2023. As its 2024 I installed the GO version. Both resulted in an interface with only 3 tabs instead of the 5 shown in this video.
@MrDenisJoshua
8 күн бұрын
Can you refresh the guide please ? I like so much how you explain and I want to add the wireguard on my Opnsense. Thanks a lot.
@mordeos9198
Жыл бұрын
Thank you very much for this awesome explanation!
@TheEminentGeek
Жыл бұрын
...great video! Thanks so much for this!
@adamcrouch
2 жыл бұрын
Excellent video! Very helpful.
@hawsroy
5 ай бұрын
this helped me a lot. thank you!
@JasonsLabVideos
Жыл бұрын
Thank you for this video :)
@hornetbad
Жыл бұрын
very good explained video man 👍👍
@rpm10k.
Жыл бұрын
Followed step by step... I can establish a connection, I can ping and nslookup stuff with my pihole at the house showing as server... but I can't browse anything on the web.
@rpm10k.
Жыл бұрын
and weirdly, it's showing traffic from 10.50.0.x to my internal 192.168.x.x server i'm tryng to log into as passing on the firewall logs.
@user-vc3hc8fh7n
Жыл бұрын
OPNsense를 처음 사용해 봐서 WireGuard 구성이 막막했는데 성공적으로 구성했습니다. 좋아요와 구독 누르고 갑니다.
@thewebart
11 ай бұрын
Thank you very much! It helped a bunch!
@tobiaskastl
4 ай бұрын
Thank you so much!
@coletraintechgames2932
11 ай бұрын
IT WORKS! Thank you!
@phuxon6379
17 күн бұрын
Those who try to do this virtually and/or bridged mode Firewall-->Settings-->Advanced Check the "Disable reply-to" box
@taimaishublm
Жыл бұрын
fantastic tutorial! thanks man
@adambeaudry3976
4 ай бұрын
Great tutorial!! Windows client works great, connects and I can access my network... Android sending and receiving handshakes are fine... but cant access anything on my network. Anyone got any suggestions???
@bretth2027
Жыл бұрын
this is great tutorial however i cannot ping any hosts behind the LAN from the wireguard VPN, everything checks out OK as per you guideline. Anything else i'm missing?
@oldanalog_synth9244
Жыл бұрын
Thank you very much 🙂
@timmark4190
Жыл бұрын
I am a bit confused about the IPs. The allowed IP's. And the client DNS IP's. And the address ip range you gave to the client
@0x2142
Жыл бұрын
Hi there - So Allowed IPs acts as a filter or access-list, which tells the wireguard config what IP addresses will be allowed over the tunnel. So on the firewall side, I set Allowed IPs to 10.50.50.15 for example - since that's the VPN address I am assigning to the client. On the client side, however, I set Allowed IPs to 0.0.0.0/0. This tells the client to forward ALL traffic to all destinations over the tunnel. The client DNS IP addresses are whichever DNS servers you would like the client to use when it's connected to the wireguard VPN. In my case, I have DNS servers that are hosted on the server side behind the firewall. So I wanted the clients to use those DNS servers once they connect to the VPN. For the client addresses, I used the 10.50.50.0/24 subnet. This can be any RFC1918 address space that you want it to be - so long as it doesn't overlap with anything used by the firewall. These addresses are only used to connect the client to the wireguard VPN server. Hope that helps!
@xgen8k
Жыл бұрын
good guide, thanks man
@ManuelMas
5 ай бұрын
I followed this steps but using it on iPhone WG client. I can’t get the handshake to work.
@gambler3k
Жыл бұрын
How do i setup wireguard to connect to my vpn provider and route ALL LAN traffic throuh the vpn? with kill switch
@sebasdt2103
8 ай бұрын
Hey! So im running into a issue where the client can connect and access the firewall gui but nothing on lan, My clients are in fulltunel mode.. IN the wg logs I see this: "Error wireguard /usr/local/opnsense/scripts/Wireguard/wg-service-control.php: The command '/sbin/route -q -n add -'inet' '10.59.59.1/24' -interface 'wg1'' returned exit code '1', the output was ''" Do you know what this could cause?
@bigneilh
Жыл бұрын
Good sir - I recently discovered a problem where I don't have internet access when connected with either my laptop or iphone. I suspect its a firewall rule or nat configuration problem. There are only 100 different reddit posts about it but I can't seem to get it to work. Any insight is appreciated! Thanks!
@bigneilh
Жыл бұрын
I figured it out - i followed the doc from opnsense but in the process of reading other peoples problems I removed the DNS entry for the client. It not works properly! Thanks!
@user-xg1dy
Жыл бұрын
Hey! What a great tutorial, congrats on that. I have one question, Do you need to have a public IP from your ISP for this tutorial to work? Or Could I just use some DDNS service to bypass that? Currently I didn't have a public IP address from my ISP. TIA
@0x2142
Жыл бұрын
Hey there, thanks for the comment! So to clarify - do you not have a public IP at all, or just not a static address? If you have a dynamic IP, then yeah you can use a DDNS service to update your public IP. That's how I've got mine set up now at home. If you don't have a public IP address at all, and you're getting a NAT from your ISP - then it may not work (or require a bit more setup).
@user-xg1dy
Жыл бұрын
@@0x2142 Thanks for the reply. I'm a network newbie, I tried with duckdns (it showed a cached IP sometimes green sometimes red) When I tried to connect from the wireguard app, it shows "sending handshake initiation" but has no response. When I'm in my house (same network) it connects succesfully, so the Wireguard tunnel is OK I think. Could you please guide me if I need to configure extra firewall rules or something else to achieve the connection via a DDNS server? How do I know if I have NAT from ISP or dynamic IP? Thanks!
@bendutton
Жыл бұрын
thanks great guide, i managed to sort everything as per your tutorial. however, i cannot ping any hosts on the LAN (192.168.1.x) my tunnel ip is 10.0.0.15/32 . am i missing something?
@Suriprofz
11 ай бұрын
same here, did u fix it/
@hphector6
2 ай бұрын
THANKS SO MUCH, I can see what i did wrong now xD
@WildFoxAlpha
Жыл бұрын
Thank you for this very detailed video! Can this procedure also being extended to setup a WireGuard Site-to-Site connection with OPNsense? Or do i just have to perform the same interface and firewall settings on the "client OPNsense" device to make it work?
@0x2142
Жыл бұрын
Yup - I haven't done that specific config yet, but my understanding is that you would just mirror the OPNsense config on both firewalls, then have each device add the other as a peer rather than the client devices.
@samollojr-er7cb
Жыл бұрын
But with the vpn it can goes to the lan of the opnsense or you have to put a route ?
@0x2142
Жыл бұрын
Yeah by default it should be able to reach the LAN. Whatever the client has set for AllowedIPs is what will be forwarded over the VPN. So 0.0.0.0/0 would include everything, LAN too.
@samollojr-er7cb
Жыл бұрын
@@0x2142 ok thanks and i have also à site to site wireguard on Two opnsense is it possible with the client to cross the other vpn site to site and Connect to other site?
@josegjimenezs
Жыл бұрын
greetings friend, if my isp provider does not give me a public ip but if I can access the internet, is there another way to use wireguard?
@Flowxing
5 ай бұрын
Worked, except for DHCP - had to set gateway and dns in Windwos. Also why are you using /32 subnets?
@nairol203
5 ай бұрын
Hey, the handshake works on my android phone but for some reason i can't connect to any website but in the firewall logs i see nothing blocked.
@nairol203
5 ай бұрын
I figured it out. I had manual outbound nat enabled. It works now after i switched to automatic/dynamic outbound nat!
@itevonix6607
Жыл бұрын
hello im facing issue with as no handshake complete,in interfaces it shows red cross with ethernet autoselect how to solve this
@trustes89
Жыл бұрын
same!!!!! :( cant get it to work
@jensg.5256
Жыл бұрын
I use my proxmox host and setup on this an Debian 11 Container with Wireguard. Now can access my home network behind CG-Nat with my smartphone that connect to LTE mobile network. Thx to IPv6
@bigneilh
Жыл бұрын
Thanks!
@0x2142
Жыл бұрын
Hey there! Thanks so much for your support 😊
@Punditmundit
Жыл бұрын
Hmm not sure why this isn't working for me. For some reason the Wireguard service in OPNsense does not start? I've re-installed the Wireguard plugin and retried this guide many times but still no joy. Any suggestions? Thank you
@mattgraham4340
Жыл бұрын
Great video
@user-kw1vj7no3t
9 ай бұрын
can you make a new guide? new version is giving me trouble
@patrickFREE.
8 ай бұрын
Why?
@AlexeiWatson
9 ай бұрын
Great tutorial. Not sure why but my widget shows an additional client for the wireguard instance that is always present, where yours doesn;t.
@0x2142
9 ай бұрын
Mine does this too with the recent OPNsense firmware
@AlexeiWatson
9 ай бұрын
@@0x2142 well that's good, it means I didn't miss any steps! Really happy to have this working, thanks.
@TismoGaming
Жыл бұрын
@8:10 how can I make it to where it only connect to my certain server at home and not the whole network?
@0x2142
Жыл бұрын
The best way would be to adjust the client configuration. For example if you had a server at 10.10.10.2 - the client's allowedIPs field should be set to 10.10.10.2/32. This would mean only traffic to that one address would be sent over the VPN.
@ziuta557
Жыл бұрын
Any chance to get help with it? It dosnt work for me.OpenVpn is working fine, but cant get connection with wireguard...
@fu1r4
Жыл бұрын
I want to use an ASUS router as server and OPNsense as client (P2P). I can't find any video on how to set this up. I have manage to make a connection between the routers. Now I need to set the correct rules and maybe even a gateway for it to work properly. Any suggestions?
@NiraldoLima
Жыл бұрын
hello, could you show us how to generate access report in OPNSENSE??
@chadwolf3840
3 ай бұрын
can you make a client on your router use wireguard without installing the wireguard client? that was something you can do on consumer routers that i liked.
@DavidsonBraga
Жыл бұрын
Hello! Thanks for your video!! But I had some problems... I followed your tutorial exactly, but the handshake on the client is not completed between OPNsense. Has this ever happened to you?
@uzairfarooqui3471
Жыл бұрын
Great video. thank you. Shouldn't there be a firewall rule on WG1 interface to allow traffic to Lan subnets? without it I couldn't even ping the VPN Headend IP.
@0x2142
Жыл бұрын
Hello there - Thanks for the comment! Yes, there should be firewall rules on the WG1 interface - depending on what traffic you want to allow. In the video, I did create a rule to allow all traffic: kzitem.info/news/bejne/w2tutqSrgqWCZnY
@Suriprofz
11 ай бұрын
rule doesnt work @@0x2142dont we need a lan rule?
@darrenb1367
Жыл бұрын
Where are you getting all these ip addresses from?
@NathanCroucher
Жыл бұрын
I got a mullvad VPN and it comes with a windows app that has wireguard, can i use that to avoid all the above? Is it same thing?
@0x2142
Жыл бұрын
Hello - It's kinda the same, just depending on what you intend to accomplish. Looks like mullvad is a generic VPN provider that focuses on securing your traffic to the internet - and they happen to use WireGuard to accomplish that. In my video, I focus on setting up WireGuard VPN to a firewall - primarily for remote access back to a home or corporate network. So if you're looking to access home network resources, then you might need to follow a similar process to what I shared. But if you are just looking to have secure / private internet access, then the mullvad VPN will work just fine. Hope that helps!!
@bigneilh
Жыл бұрын
Just an FYI: on the ios app it says allowed ip's are optional. It would not work until I entered 0.0.0.0/0 in case anyone else has this problem.
@martinzipfel7843
Жыл бұрын
Thank you for the tutorial. I had a Wireguard setup previously that used a duckdns domain name to update my public IP every time my ISP changed it. Do you know if that is possible with the OPNsense add-on as well? Cheers, Martin
@0x2142
Жыл бұрын
Hello! Yes, my setup is fairly similar to that. I am using Wireguard on OPNSense, with a dynamic DNS entry for my public IP. OPNsense has a built-in dynamic DNS plugin, and it looks like it does support duckdns.
@martinzipfel7843
Жыл бұрын
@@0x2142 Awesome. Thanks for the quick reply. I have set up the duckdns dynamic dns I just wasn't sure if that gets past on to the Wireguard add-on because no where in the setup there is a reference to the dynamic dns domain (or I missed it). Will do some playing around and see if it works. Thanks
@0x2142
Жыл бұрын
Ahh okay. Yeah wireguard just gets enabled on the public-facing interface. It doesn't care about the IP or domain name, so there isn't anywhere to configure that in OPNsense.
@martinzipfel7843
Жыл бұрын
Ok, I think it is that "Tunnel Address" setting in the interface that threw me off.
@GlennPerdicaro
Жыл бұрын
hello thnx! fantastic video; but how can i setup client whit QR code?
@TwinTailTerror
Жыл бұрын
its hard to find good opnsense stuff im happy you did this id love to chat sometime as im new to wg myself and im trying to get a few things i cant find tuts for sset up like url > ip but internally only waf and hardening my security to host games and apps but not have to worry about bad guys as i have https and redirects
@TwinTailTerror
Жыл бұрын
if ya reply here with a discord i'll come =3
@DimitrisNikolakakos
10 ай бұрын
Thank you for this tutorial. It is very comprehensive and it worked at once. The only issue I am currently faceing in some Windows client(0.5.3) the wireguard client does not connect(handshake). I also tried wireshark to capture any packets but upon wireguard client activation, not a single packet is trasmitted. Any idea why is this happening?
@0x2142
10 ай бұрын
Hmm - I haven't seen that on my Windows clients yet, and they are running the same version. With the pcap, I wonder if perhaps something else on the PC is blocking the traffic?
@DimitrisNikolakakos
10 ай бұрын
@@0x2142 I managed to solve this! I added the PersistentKeepAlive = 20 in the client config and it worked instantly!
@manuelstuder766
2 жыл бұрын
Hello. Thank you for this video. I've got one question: Is it possible to setup opnsense that it connects to an VPN Provider as client? So that all of my devices that are in my network will automaticly use the vpn connection? I've searched so many times, but I've only found tutorials how to setup opnsense's wireguard as a VPN Server but not as a Cient to an external VPN Server Provider
@0x2142
2 жыл бұрын
Hi there - In the video I do show configuration for the VPN server & VPN clients. If you were looking to connect to a different external VPN provider, they would need to support WireGuard - which is a different protocol than traditional IPSec VPNs. So there isn't any native compatibility there.
@tomaszkorytkowski1399
Жыл бұрын
not using the addresses 192.168... confuses me so much 😅😅
@l4kr
10 ай бұрын
no IPv6, downvoted
@jacobp7289
4 ай бұрын
Amazing so unintuitive this is. Of cause anyone can follow the guide and get it running. But why not make is quick and easy to do. I have wireguard running in UNRAID. It´s literally 4-5 clicks in GUI to install and setup. Then download configuration file and import into windows client. Or scan a QR code if phone is the client. Thats all it takes!
Пікірлер: 122