WireGuard Remote Access VPN Configuration Example (2024)

Required Information¶

The following basic information must be determined before starting the VPNconfiguration.

$ wg genkey | tee privatekey | wg pubkey > publickey

$ cat privatekeyWGpL3/ejM5L9ngLoAtXkSP1QTNp4eSD34Zh6/Jfni1Q=$ cat publickeyb9FjbupGC7fomO5U4jL5Irt1ZV5rq4c+utGKj53HXgU=

$ wg genkey | tee /dev/stderr | wg pubkey4BSH81zC3/OWl25XrzqWy7WnAiARXySHd+K+KFxNrWU=rzWOC0zH9v2zF6r92uCbjs7JOmhqy8N+cUdA+GCynSM=

Tunnel Configuration¶

Now it’s time to create the WireGuard tunnel.

• Navigate to VPN > WireGuard > Tunnels

• Click Add Tunnel

• Fill in the options using the information determined earlier:

  Enable:

  Checked

  Description:

  Remote Access

  Listen Port:

  51820

  Interface Keys:

  Click Generate to create a new set of keys.

  Interface Addresses:

  10.6.210.1/24

• Click Save

Peer Configuration¶

Peers can be added when editing a tunnel. To edit a tunnel:

• Navigate to VPN > WireGuard > Peers

• Click Add Peer

• Fill in the options using the information determined earlier:

  Enable:

  Checked

  Tunnel:

  tun_wg<num> (Remote Access)

  Description:

  The name of this client (e.g. The name of a person, device, username, orother uniquely identifying information.)

  Dynamic Endpoint:

  Checked

  Keep Alive:

  Typically left blank, but may be filled in if clients have problemstraversing certain firewalls.

  Public Key:

  The public key for this peer. Obtained from the key generation processearlier, or from the peer itself if it was generated by client softwaredirectly.

  Pre-Shared Key:

  Not used in this example, but for additional security this pre-shared keycan be generated and copied to the peer. Must match on the client andserver.

  Allowed IPs:

  The tunnel IP address for this peer, from the list determined above, witha /32 CIDR mask. For example, the first peer will be 10.6.210.2/32,the second will be 10.6.210.3/32, and so on.

• Click Save Peer

• Repeat the steps to add additional peers as needed.

Firewall Rules¶

First add a rule to pass external WireGuard traffic on the WAN:

• Navigate to Firewall > Rules, WAN tab

• Click Add to add a new rule to the top of the list

• Use the following settings:

  Action:

  Pass

  Interface:

  WAN

  Protocol:

  UDP

  Source:

  any

  Destination:

  WAN Address

  Destination Port Range:

  (other), 51820

  Description:

  Pass traffic to WireGuard

• Click Save

• Click Apply Changes

Next, add a rule to pass traffic inside the WireGuard tunnel:

• Navigate to Firewall > Rules, WireGuard tab

• Click Add to add a new rule to the top of the list

• Use the following settings:

  Action:

  Pass

  Interface:

  WireGuard

  Protocol:

  Any

  Source:

  any

  Destination:

  any

  Description:

  Pass VPN traffic from WireGuard peers

• Click Save

• Click Apply Changes

Client Configuration¶

Client configuration varies by platform, see WireGuard documentation fordetails. This section covers a basic configuration.

This is an example configuration from a WireGuard client for a split-tunnel configuration:

[Interface]PrivateKey = WGpL3/ejM5L9ngLoAtXkSP1QTNp4eSD34Zh6/Jfni1Q=ListenPort = 51820Address = 10.6.210.2/24[Peer]PublicKey = PUVBJ+zuz/0mRPEB4tIaVbet5NzVwdWMX7crGx+/wDs=AllowedIPs = 10.6.210.1/32, 10.6.0.0/24Endpoint = 198.51.100.6:51820

This is an example configuration from a WireGuard client for a full-tunnel configuration:

[Interface]PrivateKey = WGpL3/ejM5L9ngLoAtXkSP1QTNp4eSD34Zh6/Jfni1Q=ListenPort = 51820DNS = 10.6.210.1, pfSense.home.arpaAddress = 10.6.210.2/24[Peer]PublicKey = PUVBJ+zuz/0mRPEB4tIaVbet5NzVwdWMX7crGx+/wDs=AllowedIPs = 0.0.0.0/0Endpoint = 198.51.100.6:51820

The fields in that file are as follows:

Interface:

Settings for this client.

PrivateKey:

The private key for this peer. Obtained from the key generation processearlier, or from the peer itself if it was generated by client softwaredirectly.

ListenPort:

A static port to listen on, or omit the line to use a random port instead.

DNS:

The DNS server(s) and search domain that should be used by the system whenthe tunnel is enabled.

Address:

The tunnel address for this client. Not supported on all platforms, as somerequire configuring the address using command-line utilities. However,clients on Windows and Android, for example, support this directive.

This should use the same CIDR mask as the Tunnel address. In thisexample, the first peer is 10.6.210.2/24.

Peer:

Configuration for the firewall end of the tunnel.

PublicKey:

The public key from the Tunnel configuration on the firewall.

AllowedIPs:

The Tunnel address, and any additional networks which should be routedacross the VPN in a comma-separated list. This could be a LAN subnet (e.g.10.6.0.0/24) or use 0.0.0.0/0 to route all traffic, includingInternet traffic, across the tunnel.

Endpoint:

The firewall WAN IP address and WireGuard Listen Port

Transfer the resulting client configuration file to the peer in a secure manner.Methods vary by platform and client software.

Finish Up¶

After configuring the client and activating the VPN, the client should be ableto pass traffic to the networks listed in the AllowedIPs list in itsconfiguration.