---
title: Manually Generate Wireguard Peer in OPNsense
description:
published: false
date: 2025-12-13T11:39:23.471Z
tags:
  - networking
editor: markdown
dateCreated: 2025-05-04T11:38:34.846Z
---

# Manually Generate Wireguard Peer in OPNsense
This guide details how to manually (not using the Peer Generator) generate a new Wireguard peer in OPNsense.


## Requirements
The `wireguard-tools` package must be installed to generate the public and private keys.



### 1. Create a Peer

1. Generate a new public and private key with 
`wg genkey | tee privatekey | wg pubkey > publickey`
This will create two files in the current directory with the public and private key. Save these for later.

2. In the OPNsense UI go to VPN > Wireguard > Peers, and click the + to add a new peer

3. Fill in the details:
   - **Name**: Enter a name for the peer
   - **Public key**: Paste the public key you generated earlier
   - **Pre-shared key**: Generate a key if desired and save it for later
   - **Allowed IPs**: Specify the IP address or subnet that this peer is allowed to use (e.g., 10.0.60.2/32). Check your existing peers to ensure it is not already used
   - **Endpoint address**: Leave blank if the client will be roaming
   - **Endpoint port**: Leave blank
   - **Instances** Choose appropriate instance
   - **Keepalive**: Can be left blank

4. Save the Configuration 

### 2. Create the Wireguard Config File

1. Create a new file called `<NAME>.conf`. You can choose the name.
2. Copy and paste the contents from below into the file and update the values:
```
[Interface]
PrivateKey = <private-key>
Address = 10.0.60.2/32  # Use the same IP address or subnet specified in OPNsense
DNS = 8.8.8.8  # Optional: Specify a DNS server, not required if only routing resources (not an Internet connection) or using DNS names.

[Peer]
PublicKey = <opnsense-public-key>
PresharedKey = <preshared-key> # Only needed if generated in previous step
Endpoint = <opnsense-public-ip>:51820  # Replace with the OPNsense public IP and port
AllowedIPs = 0.0.0.0/0  # Route all traffic through the VPN
```

Replace `private-key`, `opnsense-public-key`, `preshared-key`, and `opnsense-public-ip` with the appropriate values.

For `AllowedIPs`, setting `0.0.0.0/0` will route all IPv4 addresses via the VPN connection. If only access to resources and no internet connection is required, the subnets can be added here i.e. `10.0.60.0/24, 10.0.70.0/24`

4. Import the `.conf` file into the VPN connection settings on the client device and test the connection.