WireGuard on OPNsense is configured by combining an Instance (server-side virtual interface settings) with Peers (authorized connection partners). OPNsense official documentation recommends designing tunnel addresses as an independent network, as if a separate physical interface exists.^[1][2]

• You can log in to the OPNsense management UI
• UDP port 51820 is available on the WAN side
• If OPNsense is behind an upstream router, you can forward UDP 51820 to the OPNsense WAN
• You can provision a WireGuard network that does not overlap with the target LAN segment
• You can install the official WireGuard for Windows on the Windows client

The explanation in this article uses the following example for consistency. These values are samples only; replace them with your organization’s address scheme in production.

After saving, open the Instance again and record the Public Key.
This public key is the server-side public key to enter in the Windows client settings later.^[1]

Current OPNsense documentation recommends using Peer generator for distributing configuration to multiple clients. It enables instance selection, endpoint saving, automatic address assignment, and Config text generation, with only the public key stored on OPNsense. Since the private key is not retained on OPNsense, securely store the generated configuration.^[2][3]

Recommended procedure: Using Peer generator #

1. Open VPN > WireGuard > Peer generator.
2. Select the target Instance and enter the client name, connection destination FQDN/port, required networks, and DNS.
3. Assign an address like 10.10.10.2/32 as a client-specific address. Automatic address assignment is also available in the current implementation.^[3]
4. Keepalive interval of 25 seconds is recommended (from a connection persistence perspective across NAT and firewalls)
5. DNS is typically blank; however, if you need host name resolution via the VPN destination’s DNS server, specify it here.
6. Check Enable WireGuard
7. Store and generate next to save public information, copy the generated Config, and securely save it as client-windows.conf. Then run Apply on the Peers screen.^[2]

Manual Peer creation #

If you do not use Peer generator, create a new Peer at VPN > WireGuard > Peers, and set the client public key and /32 address for client use.^[1]

After manually creating the Peer, return to the original Instance, associate the created Peer, save, and run Apply.^[1]

[Interface]
PrivateKey = <Windows client private key>
Address = 10.10.10.2/32
DNS = 10.10.10.1

[Peer]
PublicKey = <OPNsense Instance public key>
Endpoint = vpn.example.jp:51820
AllowedIPs = 192.168.10.0/24, 10.10.10.0/24

OPNsense official guidance indicates that you do not need to set an IP directly on the assigned interface; the tunnel address entered in the Instance is automatically reflected after a WireGuard restart.^[1]

The official procedure uses a two-tier approach: allow UDP on the WAN side for tunnel establishment, then allow approved destinations on the WireGuard interface side.^[1][2]

WAN side rule #

WireGuard interface side rule #

OPNsense official guidance permits setting the WireGuard rule destination to any, but in operational practice, restricting to necessary subnets and servers only is recommended.^[1]

On the Windows side, using the official WireGuard for Windows is the simplest approach. The installer is available from the WireGuard official website.^[4]

1. Install WireGuard for Windows.
2. Prepare the client-windows.conf saved from OPNsense Peer generator. For manual creation, use the template provided earlier.
3. Import the configuration file into WireGuard for Windows.
4. Enable the target tunnel and begin the connection.

[Interface]
PrivateKey = <Client private key>
Address = 10.10.10.2/32
DNS = 10.10.10.1

[Peer]
PublicKey = <OPNsense public key>
Endpoint = vpn.example.jp:51820
AllowedIPs = 192.168.10.0/24, 10.10.10.0/24

By including LAN segments like 192.168.10.0/24 in AllowedIPs, only that destination is sent through the tunnel. If you want to route all client traffic through the VPN, use 0.0.0.0/0 or ::/0 per official guidance, but additional NAT / routing design on the OPNsense side is also required.^[1]

• Enable the tunnel on the Windows client
• Test connectivity to 10.10.10.1 (OPNsense tunnel IP)
• Try ping, RDP, SSH, and other connections to a representative LAN host (example: 192.168.10.10)
• Test name resolution as needed and verify that DNS works
• Check handshake and send/receive statistics at VPN > WireGuard > Status^[2]

1. OPNsense Documentation, WireGuard Road Warrior Setup
   https://docs.opnsense.org/manual/how-tos/wireguard-client.html
2. OPNsense Documentation, Virtual Private Networking > WireGuard
   https://docs.opnsense.org/manual/vpnet.html
3. OPNsense Documentation, 24.1 “Savvy Shark” Series (includes Peer generator updates)
   https://docs.opnsense.org/releases/CE_24.1.html
4. WireGuard Official, Installation
   https://www.wireguard.com/install/