Run a leak test at via one of the internal network clients attached to your OPNSense router. Source Address should be LAN net and set Translation / target to Interface address.Ĭlick the Save button, click the Apply Changes button, then reboot the OPNSense router. Add a rule and select Wireguard as Interface. Check that rule generation is set to Manual or Hybrid. Go to Firewall > NAT > Outbound and click +Add to add a rule. To let you internal network clients go through the tunnel, add a NAT entry. Click the Save button at the bottom of the page, then click the Apply changes button at the top of the page. Go to the Interfaces > LAN page and set the MSS value to 1412. Go to the VPN > WireGuard > General tab and put a check mark beside Enable WireGuard on the General tab, then click the Save button.Ĭheck the VPN > WireGuard > List Configuration and Handshakes tabs to see connection details. Remove the temporary placeholder from the Tunnel Address field and enter the IP address from the step above plus the /32 netmask (172.x.y.z/32). Go back to the OPNSense web interface and the local interface that is being edited. This is the IP address your computer system will have on our internal network. Make note of the IPv4 Address beside your newly added public key on the WireGuard tab in the Client Area. The Private Key must always be kept a carefully guarded secret. Add a comment, like OPNSense if you prefer, and click the Add Key button.īe sure to copy the Public Key and not the Private Key.
Copy the contents of the Public Key from OPNSense and paste them into the Public Key: field. Go to WireGuard Key Management located under Tools. On the VPN Accounts page in the Client Area on our website, click the WireGuard tab.
Peers: Choose the Endpoint (VPN server location) you created in the previous step.Ĭlick the Save button to generate your Public and Private keys.Ĭlick the pencil icon to edit the local interface you created in the previous step and make note of your Public Key. Tunnel Address: Enter a temporary placeholder address, like 10.9.9.9 Listen Port: Default value is likely fine.ĭNS Server: The DNS server can be one of three options:ġ72.16.0.1 = regular DNS with no blockingġ0.0.254.2 = standard AntiTracker to block advertising and malware domainsġ0.0.254.3 = Hardcore Mode AntiTracker to also block Google and Facebook domains
0 kommentar(er)
