Configuring Native WireGuard on pfSense
Deploy the native WireGuard package on pfSense with interface assignment, firewall rules, and NAT outbound configuration.
Senior Network Engineer
Overview
pfSense 2.6+ ships a native WireGuard package. This guide covers installing the package, defining a tunnel and peer, assigning the interface, and writing the firewall rules that make LAN traffic exit through the tunnel.
Install the package
Under System > Package Manager > Available Packages, install wireguard. Restart the firewall once installation completes.
Configure the tunnel
Create the tunnel
Under VPN > WireGuard > Tunnels, add a new tunnel, generate a key pair, and set the listen port.
Add a peer
Under the Peers tab, paste the server public key, endpoint, and allowed IPs. Enable Keepalive at 25 when the firewall is behind NAT.
Assign the interface
Under Interfaces > Assignments, promote the tunnel to a real interface (e.g. OPT1). Enable it and give it a description.
Write firewall + NAT rules
Under Firewall > NAT > Outbound, switch to Hybrid mode and add a rule masquerading LAN traffic out the WireGuard interface. Under Firewall > Rules > WireGuard, allow inbound reply traffic.
Validation
Under Status > WireGuard, confirm a recent handshake. Run a public IP check from a LAN client and confirm the visible IP matches the tunnel endpoint.