Pfsense WireGuard Client Working ( With Catch 22 )



  • Dear Community,
    This tutorial guide details dead simple GUARANTEED process to get WIREGUARD Client up and running on pfSense Firewall. Some of you may remember my work with GETDNS and STUBBY. This installation is for commercial WireGuard Clients ONLY ! - where creation of keys and how to exchange them is not needed. The keys are generated and managed by your WireGuard VPN service provider - in my case - TorGuard.

    1 - This is what I did and it worked out great. First go to https://pkg.freebsd.org/FreeBSD:11:amd64/latest/All/  as pfSense is based on FreeBSD 11 - the current WireGuard release is version - July 2019 wireguard 0.0.20190702 . To get started install bash # pkg install bash ( as it is need by WireGuard-GO ). Scroll down page on FreeBSD package website ( find wireguard and wireguard-go ) Then issue these commands: # pkg add -f
    https://pkg.freebsd.org/FreeBSD:11:amd64/latest/All/wireguard-go-0.0.20190517.txz and # pkg add -f https://pkg.freebsd.org/FreeBSD:11:amd64/latest/All/wireguard-0.0.20190702.txz  - As I said, this will install latest versions of these packages. W are now ready to get this going and up and running. Just follow these steps below:
    

    2 - To begin you need to get your WIREGUARD configuration files from the TORGUARD website. To do so login your TORGUARD account then go to Tools ( along the top of Login Page ) from drop Down Menu click on Enable WIREGUARD Access. You will then be in your TorGuard Account Area. You will see this message along the top : Below is a list of WireGuard VPN Servers, Please click enable in front of the servers you like to connect to, and use the returned keys shown to connect. Currently, TORGUARD offers WIREGUARD Servers in USA - New York ( quite actually situated in Clifton, New Jersey ), Asia - Singapore and Europe - UK. Click on your preferred Server - Enable WIREGUARD. This will result in a green box below the now grayed out box - which states now Disable WIREGUARD- naturally leave your server enabled as you want to connect to the now enabled server. Next, Download Config file as the box allows you to do now that you have enabled your WIREGUARD Server. You will also see in the adjoining box the following :

    Location VPN Server Keys Manage
    USA - New York 1 159.xx.xxx.xx:xxx Server Public key: 62lKu9HsDVbyiPenApnc4sfmSYTHOVfFgL3pyB+cBL4=
    Your Private Key: cE2ecALeE5B+urJhDrJlVFmf38cJLAvqekONvjvpqUA=
    Your Address: 10.xx.x.xxx/24

    3 - Now I used this guide as the template for my manual installation of WIREGUARD on OPNsense see here : https://genneko.github.io/playing-with-bsd/networking/freebsd-wireguard-quicklook/ I will make this simple for you step by step. You may sing and / or hum along as we proceed.
    A- First - configure WireGuard Client. TorGuard, AzireVPN, VPN.ac, Mullvad, IVPN, are commercial VPN providers which offer LIVE ! WireGuard Services now. I use TorGuard here is a sample file. Keys are dummies - only used for illustrative purposes in this tutorial- Use your real WireGuard configuration file here: Create file by command line - # nano /usr/local/etc/wireguard/wg0.conf - and enter the configuration file below ( copy and paste ) - substitute your real one. Save and Close. Done with this file.

    
    # TorGuard WireGuard Config
    [Interface]
    PrivateKey = foxZRnIh9gZpWnl+zEiKa0EJ2rdCGroMWm02gaxSc9Q=
    ListenPort = 51820
    DNS = 104.223.91.210
    Address = 10.xx.x.xxx/24
    
    [Peer]
    PublicKey = 62lKu9HsDVbyiPenApnc4sfmSYTHOVfFgL3pyB+cBL4=
    AllowedIPs = 0.0.0.0/0
    Endpoint = 159.xx.xx.xxx:xxx
    PersistentKeepalive = 25
    

    B - Secondly, run command via SSH # wg-quick up wg0 ( wireguard-go is in package and this action creates wireguard interface ) You may also run # wireguard-go wg0 to create wg0 - however, I prefer to use the first method mentioned here.

    4 - Configure WireGuard Service with rc.d - for automatic startup/shutdown of the tunnel. In order to achieve this there’s already an rc.d script /usr/local/etc/rc.d/wireguard which came with the wireguard package. You need to issue this command :  # mv /usr/local/etc/rc.d/wireguard /usr/local/etc/rc.d/wireguard.sh then enter the file - # nano /usr/local/etc/rc.d/wireguard.sh Then go to bottom of file - lines 46 and 47 - change : ${wireguard_enable="NO"} to : ${wireguard_enable="YES"} and then add wg0 on line 47
    : ${wireguard_interfaces=""} to : ${wireguard_interfaces="wg0"} ( wgZero ) - Save and Close - Make it executable, I run two commands - it works for me: # chmod a+x /usr/local/etc/rc.d/wireguard.sh # chmod 744 /usr/local/etc/rc.d/wireguard.sh - Done with this file.
    

    5 - Now head to pfSense WEBGUI in order to configure Wireguard Interface ( created earlier ) and FireWall Rule. First, go to Interfaces > Assignments -you will see wg0 interface - click (+) add button /symbol. Once the wg0 interface is listed as OPT ( 1 - 2 depending on your setup ) - Click underneath it - - enter check in " Enable interface " - and enter description - I call mine " WIRE " - DO NOTHING ELSE HERE ! Save and Apply - Done with this phase.
    Second - Firewall Rule - go to Firewall > NAT > Outbound > Once on this Landing Page put a Dot in radio button Hybrid outbound NAT rule generation - Click on Save - Do Not - Repeat Do Not Click Save and Apply At This Time - Instead Click on Add Square with Up Arrow (underneath Mappings ) on the page which opens change Interface from WAN in drop down menu to your Wireguard ( wg0 ) Interface which you created and labeled previously - in this example
    " WIRE " . Next - Change Source Address to " LAN NET " . You must manually enter your LAN NET . For example if your LAN Address is 192.168.11.10 - then enter 192.168.11.0/ 24 . Finally, set ( leave ) Translation/target to Interface address. Enter " Description -e.g. " Made For Wire " now Click " Save " at bottom of page. You will be taken back to Firewall:Nat:Outbound Landing Page - Click on " Apply Changes " in right upper hand corner - Done with Firewall Rule for LAN. Repeat this Firewall Rule Operation for all of your other LAN Interface Subnets if you choose to do so.
    6 - Your WireGuard Client is now installed and ready - you must enter command # /usr/local/etc/rc.d/wireguard.sh restart in order to start it up. Lastly, issue command # wg show which prints out your WireGuard Connection statistics and configuration. Sample output for wg show below:

    interface: wg0
    public key: cE2ecALeE5B+urJhDrJlVFmf38cJLAvqekONvjvpqUA=
    private key: (hidden)
    listening port: 51820

    peer: 62lKu9HsDVbyiPenApnc4sfmSYTHOVfFgL3pyB+cBL4=
    endpoint: 159.x.xxx.xxx:xxx
    allowed ips: 0.0.0.0/0
    latest handshake: 1 minute, 46 seconds ago
    transfer: 3.35 MiB received, 859.23 KiB sent
    persistent keepalive: every 25 seconds

    7 - The Catch 22: Good and Bad News. When you reboot your pfSense FireWall, the WireGuard interface will be removed. Further you will be asked and required to " Assign Interfaces " again. You will see this message : Network interface mismatch - Running interface assignment option - In order to get your WireGuard VPN up and running again simply follow these steps after reassigning your vlans ( if you have any ), WAN, and LAN interfaces. All your network configurations will have been preserved including your firewall rules, addresses and so on.
    A - Remember your WireGuard interface ( wg 0 ) was removed on reboot. so, simply repeat this step to add it again: In the pfSense WEBGUI go to Interfaces > Assignments -you will see wg0 interface - click (+) add button /symbol. Once the wg0 interface is listed as OPT ( 1 - 2 depending on your setup ) - Click underneath it - - enter check in " Enable interface " - and enter description - I call mine " WIRE " - DO NOTHING ELSE HERE ! Save and Apply - Done with this phase.
    B - In order to get WireGuard up and running again - simply issue this command once again - # /usr/local/etc/rc.d/wireguard.sh restart
    You do not have to recreate any of your Firewall Rules as they are all still there. Your WireGuard VPN connection is now reestablished.
    Last Notes and Thoughts: I realize that this implementation is not perfect albeit it works. I run OpenVPN on pfSense as well. You must disable OpenVPN client before and when running WireGuard. I will write up a tutorial to switch between OpenVPN and WireGuard on pfSense. Currently, I am running WireGuard on pfSense 2.5.0 Development SnapShot VmWare Machine. pfSense 2.5.0 is based on FreeBSD 12 - so you must modify url's thusly and get the packages from : https://pkg.freebsd.org/FreeBSD:12:amd64/latest/All/ If anyone can provide me with a solution that will allow WireGuard interface ( wg0 ) the ability to survive a reboot; I will be most appreciative and edit this tutorial to include that solution.

    Peace and Grace Be Unto All God's Creation


  • LAYER 8 Global Moderator

    @ubernupe said in Pfsense WireGuard Client Working ( With Catch 22 ):

    Some of you may remember my work with GETDNS and STUBBY.

    Yup sure do - complete and utter waste of time and effort.. Guessing this in the same line?

    If someone wants to run wireguard, wouldn't it just be easier to run it on another box/vm?

    If your actually worried about security, etc.. dicking with the stuff the makes up your "firewall" is not something I would suggest anyone do to be honest..

    In my opinion, take it how you will.. Wireguard will be added to pfsense when the developers deem it ready to be added, or someone creates a package that adds it that the developers sign off on and include in the package system..

    And such off the reservation sort of "hacks" your firewall system is not something I would recommend anyone play around with.. But maybe that is just me ;)



  • @johnpoz
    Dear johnpoz,
    Hello and I hope that you are well. First, let me begin by stating that I do understand and accept the validity of your comments and criticisms of " hacking " pfSense FireWall. Just to let you know my thinking, I love pfSense and I think that you guys do a great job overall. However, as I am retired ( English Teacher ) with time on my hands - I do love to " dick " around with network applications - especially those in the realm of security. There are other BSD based firewall distros that already offer both getdns plus stubby as well as wireguard packages in their repositories. pfSense seems to lag behind often; moreover, as I search for answers that I have about these solutions - I find that many other pfSense devotees also are seeking how to implement these emerging protocols - e.g. - DNS PRIVACY and WIREGUARD. My tutorials are more " proof of concept " than anything and yes - I realize that I am " pushing the envelope ". However, the fact that you call DNS PRIVACY Project work : https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Project+Homepage ( getdns and stubby ) " a complete and utter waste of time and effort " and that " Wireguard will be added to pfsense when the developers deem it ready to be added, or someone creates a package that adds it that the developers sign off on and include in the package system. " proves the point that pfSense is unresponsive to many of the interests of pfSense users . I run a different edge router than pfSense currently, and I can assure you that I will not post any additional " hacking " solutions on the pfSense Forum.
    However, I am left wondering why pfSense is such a top down distro in its' decision making and does not more readily respect the input or feedback from its' user base. I dare say that some of your replies to me smack of disdain, dismissal and outright mockery. I respectfully submit to you that the work I have done here is reflective of the work being done across a wide spectrum of Linux and BSD distributions - and I suggest that you do read what work the DNS Privacy Project is actually doing. Again Peace and God Bless
    ubernupe


  • LAYER 8

    you should not take it personally, johnpoz is like that, you can teach english, he can teach networking and security, people will read your tutorial and try to mimic it, if they do something wrong it may be dangerous for a firewall or it could interfere with future updates, alot of thing can go wrong. it's the duty of a moderator to advise against stuff like this, if you want something to be officially added to pfsense you should go to redmine.pfsense.org and ask for a new feature. that said if someone is interested in your work no one will prevent him from following it. provided they understand that they do so at their own risk.
    The protocol called DNS over TLS run on port 853, network operators that dislike DoT can easily block it. Most corporate networks will in fact do this by default, then we have all the other stuff like doh doc
    It is generally possible to tell where a TLS connection is going even without looking at DNS since the name still travels in plaintext.. there is little/no privacy differential when using DNS over HTTPS
    if it's your concern. the request will be in any case decrypted by the dns you query. so moving your personal information from your ISP to google IMHO it's bullshit, an excess of privacy. the other reason to have DNS over HTTPS / TOR it's to break the censorship in your country so you are free to search for all that illegal stuff / censored pornography that your country impose. i really don't think any of this have anything to do with a product of a certain seriousness that points to security.
    this is only my 2cents



  • @kiokoman
    Dear kiokoman,
    I opened my reply to johnpoz by stating that I do understand and accept the validity of your comments and criticisms of " hacking " pfSense FireWall. Further I ended with I can assure you that I will not post any additional " hacking " solutions on the pfSense Forum. On the topic of DNS OVER TLS - you can also run that protocol on Port 443 as many of the providers here from The DNS PRIVACY Project : https://dnsprivacy.org/jenkins/job/dnsprivacy-monitoring/ - offer DNS TLS on port 443. Also, DNS OVER TLS is suggested to be run in conjunction with a secure VPN service. Again, thank you and johnpoz and I will be a good team player
    Peace
    ubernupe


Log in to reply