The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

    Mastodon

  • Twitter Updates

  • My Flickr Stream

    20140508-Delphi-2007--Project-Options--Cannot-Edit-Application-Title-HelpFile-Icon-Theming20140430-Fiddler-Filter-Actions-Button-Run-Filterset-now20140424-VMware-Fusion-6.0.3.-no-reclaimable
    More Photos

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,862 other subscribers
«
»

rcmcdonald91/pfSense-pkg-WireGuard: This is a port of the original WireGuard UI bits as implemented by Netgate in pfSense 2.5.0 to a package suitable for rapid iteration and more frequent updating on future releases of pfSense.

Posted by jpluimers on 2025/12/25

This is actually the WireGuard package you can install on pfSense CE 2.5.2 and higher: [Wayback/Archive] rcmcdonald91/pfSense-pkg-WireGuard: This is a port of the original WireGuard UI bits as implemented by Netgate in pfSense 2.5.0 to a package suitable for rapid iteration and more frequent updating on future releases of pfSense.

Note that the source code mentions a lot of web-technologies but that is because the majority of the code is the pfSense plugin. Underneath it pulls the actual build from [Wayback/Archive] git.zx2c4.com/wireguard-freebsd/snapshot which is almost exclusively C code.

Like WireGuardNT on Windows, it uses a high performance kernel mode driver.

Some more links on it:

WireGuard repositories:

WireGuard on Linux:

One of the best videos on getting site-to-site WireGuard running between two pfSense devices: [Wayback/Archive] Basic Site-to-Site VPN Using WireGuard and pfSense – YouTube

Timestamps:

  • 0:00 Introduction
  • 1:10 Site-to-Site Routing 101
  • 12:54 WireGuard Configurations
  • 17:25 WireGuard Allowed IPs
  • 22:15 Interface Assignments
  • 24:53 Upstream Gateways and NAT Implications
  • 27:15 Gateways and Static Routes
  • 30:12 Firewall Rules
  • 35:15 Demonstration
  • 43:46 Wrapping things up

Another video that to me was slightly more clear on the firewall settings was [Wayback/Archive] Tutorial: How to Configure WireGuard and pfSense for Remote Access – YouTube.

It also showed another trick, which is to generate the required private and public keys plus configuration files used by other WireGuard implementations on-line. This is convenient, especially for mobile applications as these benefit from the generated QR codes. Some of these sites are below.

Peers can be road warriors without a known IPv4

[Wayback/Archive] Virtual Private Networks — WireGuard — Design Considerations | pfSense Documentation

WireGuard does not have a concept of “Client” and “Server” per se, but depending on the configuration the firewall can behave in a manner similar to a “Client” (initiates locally, remote never initiates) or “server” (never initates, remotes always initiate).
Technically every WireGuard tunnel is a peer to peer connection, but there are three main ways a WireGuard tunnel can be configured depending on whether or not a peer endpoint is known or defined:
  • Site-to-Site (peer endpoint filled in on both sides)
  • Remote Access “Server” (endpoint only filled in on remote peers)
  • Remote Access “Client” (endpoint only filled in locally, not on the “server” peer)
Any of those roles can technically be configured no matter how the peer endpoint settings are defined, but not defining an endpoint on one side or the other limits the capacity in which a peer can operate.
Typically, a tunnel is defined with a known peer IP address or hostname for the endpoint, which could take advantage of Dynamic DNS for dynamic peers. This is the most secure method as it locks the tunnel down to specific known peers, but that is not always practical.
In the case of remote access style setups, the peer endpoint address is typically unknown and can change at any time. In this case, the peer endpoint can be left blank and WireGuard will accept connections from any remote address, validating the key instead.

Configuring other peers than pfSense is harder than needed

Since at the time of writing, there is no easy way to export peer configuration (see below) it is a bit tougher than needed to configure non-pfSense systems as peers.

For instance, Android benefits from being able to read the config via a QR Code. Otherwise it is a manual key exchange (public pfSense tunnel interface key goes to Android; Android public peer key goes to pfSense).

Anyway: here are some links that also discuss connecting non-pfSense clients:

Oh, and the Android client of course:

Online WireGuard configuration generators

The above idea is cool, so I searched for more so that you can try them and get a feel for which one is the most secure (some are console scripts which you are sure won’t communicate security details back to a server side):

The search for the above links also taught me about GitHub topics: [Wayback/Archive] wireguard-config-gen · GitHub Topics.

That last link also made me find these that are interesting outside the pfSense context:

Will pfSense allow export itself?

At the time of writing this was a long standing feature request:

Hopefully by now…

Why use the /32 network for peer AllowedIPs?

My first every WireGuard setup was just of two nodes talking to each other thereby allowing traffic between the two underlying LANs.

So I wondered why on the tunnel network interface [Interface] side Address was using /24, but on the [Peer] side AllowedIPs was using /32.

So I found these interesting links:

One host, multiple peers

These are related to the /32 posts above:

Videos

Most via [Wayback/Archive] pfsense wireguard site to site – YouTube.

Queries

–jeroen

This entry was posted on 2025/12/25 at 12:00 and is filed under Conference Topics, Conferences, Development, DVCS - Distributed Version Control, Event, git, GitHub, Hardware, Network-and-equipment, pfSense, Power User, routers, Software Development, Source Code Management, Tailscale. Tagged: , . You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

Leave a comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.

«
»