1

generate wireguard

Lucas Mathews edited this page 2025-12-28 11:59:13 +01:00

Table of Contents

• Manually Generate Wireguard Peer in OPNsense
• Requirements
• 1. Create a Peer
• 2. Create the Wireguard Config File

Manually Generate Wireguard Peer in OPNsense

This guide details how to manually (not using the Peer Generator) generate a new Wireguard peer in OPNsense.

Requirements

The wireguard-tools package must be installed to generate the public and private keys.

1. Create a Peer

1. Generate a new public and private key with wg genkey | tee privatekey | wg pubkey > publickey This will create two files in the current directory with the public and private key. Save these for later.

2. In the OPNsense UI go to VPN > Wireguard > Peers, and click the + to add a new peer

3. Fill in the details:

   • Name: Enter a name for the peer
   • Public key: Paste the public key you generated earlier
   • Pre-shared key: Generate a key if desired and save it for later
   • Allowed IPs: Specify the IP address or subnet that this peer is allowed to use (e.g., 10.0.60.2/32). Check your existing peers to ensure it is not already used
   • Endpoint address: Leave blank if the client will be roaming
   • Endpoint port: Leave blank
   • Instances Choose appropriate instance
   • Keepalive: Can be left blank

4. Save the Configuration

2. Create the Wireguard Config File

1. Create a new file called <NAME>.conf. You can choose the name.
2. Copy and paste the contents from below into the file and update the values:

[Interface]
PrivateKey = <private-key>
Address = 10.0.60.2/32  # Use the same IP address or subnet specified in OPNsense
DNS = 8.8.8.8  # Optional: Specify a DNS server, not required if only routing resources (not an Internet connection) or using DNS names.

[Peer]
PublicKey = <opnsense-public-key>
PresharedKey = <preshared-key> # Only needed if generated in previous step
Endpoint = <opnsense-public-ip>:51820  # Replace with the OPNsense public IP and port
AllowedIPs = 0.0.0.0/0  # Route all traffic through the VPN

Replace private-key, opnsense-public-key, preshared-key, and opnsense-public-ip with the appropriate values.

For AllowedIPs, setting 0.0.0.0/0 will route all IPv4 addresses via the VPN connection. If only access to resources and no internet connection is required, the subnets can be added here i.e. 10.0.60.0/24, 10.0.70.0/24

4. Import the .conf file into the VPN connection settings on the client device and test the connection.

🏠 Main

• Home

📚 Guides

💽 Applications

• Create SSH Keys for Gitea

🛜 Networking

• Generate Wireguard Peer in OPNsense
• VPS Reverse Proxy

🖥️ OS

• Upgrade Windows OS Product Key
• RDP to Windows PC with Microsoft Credentials

This wiki is version controlled - view the commit history