Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    I made a WireGuard package for pfSense

    Scheduled Pinned Locked Moved
    pfSense Packages
    40
    178
    86.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      a.katib91 @Talisker
      last edited by

      @Talisker thanks, that worked.

      1 Reply Last reply Reply Quote 0
      • T
        Talisker
        last edited by

        I am having huge problems with the 2.5 version. The tunnel goes up and traffic flows. After a while it just stops. The only solution I have found is to reboot the firewall. Slightly annoying.

        However. The 2.4.5 version is working perfectly. No downtime the last two weeks with Lucasnz package.

        Btw, I discovered "Tag" and "Tagged" with floating rules in order to prevent traffic to leave the wrong way (directly to internet). PFSense is really weird considering rules and routing.

        1 Reply Last reply Reply Quote 0
        • D
          dubatech
          last edited by dubatech

          Don't know if happened to someone else, but I've problems with the 4th tunwg interface created.
          I've removed tunwg3, then reinstalled @lucas_nz pkg, but nothing:

          7ba362eb-b1da-43c7-af7a-3df63802365d-immagine.png

          Here is the output of ifconfig:

          3a1ca353-4d51-4296-98df-935307c60290-immagine.png

          Is there a way to delete it?
          I've created a new interface tunwg4 and it works but tunwg3 still visible.

          I'm on pfSense 2.4.5-RELEASE-p1 and using lucasnz pkg v1.0.1.

          Thank you so much

          Update: OK, just a reboot fixed the problem!

          1 Reply Last reply Reply Quote 0
          • A
            abidkhanhk @Ascrod
            last edited by

            @Ascrod

            Hi is there a guided tutorial on how to implement the package in pfsense?

            Thanks

            T U 2 Replies Last reply Reply Quote 0
            • T
              Talisker @abidkhanhk
              last edited by

              @abidkhanhk I followed the how to earlier in this thread.

              1 Reply Last reply Reply Quote 1
              • U
                ubernupe @abidkhanhk
                last edited by

                @abidkhanhk

                For you and any and all seeking a setup guide - see below :

                https://forums.torguard.net/index.php?/topic/1975-ascrod-ashus-pfsense-pkg-wireguard-tutorial-guide/

                Also if you read through this thread see here ( my post ) - you can see the attached text for how to build / compile packages - and much more :

                https://forum.netgate.com/topic/150943/i-made-a-wireguard-package-for-pfsense/125

                Peace -

                1 Reply Last reply Reply Quote 1
                • A
                  abidkhanhk
                  last edited by

                  @ubernupe

                  Many thanks!!! exactly what i was looking for.

                  1 Reply Last reply Reply Quote 0
                  • T
                    TidalWave123
                    last edited by TidalWave123

                    Hi Guys,

                    I'm just curious. How long do you all think it will take to get wireguard as an offical package for pfsense? I'm pretty egar to start using it.

                    I would ideally like to have it running on a pfsense box that way I can have suricata and other things running to protect it. But who knows, maybe I can just run wireguard as a linux server behind a pfsense box.

                    Anyways, I just did a test on performance. I have a 1 gig office network and a 1 gig home network. Bother are 1000/1000Mbps. So I did iperf on openvpn and got 50Mbps, when I ran an SMB file transfer over the tunnel I got 350Mbps.

                    Then I did iperf on wireguard tunnel and got 300Mbps, and the SMB file transfer of 688Mbps which might be line speed considering overhead and travel time over the WAN?

                    This is a pretty powerful technology and I'm seriously considering putting it out in some of my production environments. I also like how simple it is to setup compared to OpenVpn. The only negative is that the Mac version of wireguard only works with Mojave or later.

                    Best,
                    Tidal

                    1 Reply Last reply Reply Quote 1
                    • V
                      victorhooi
                      last edited by

                      @ubernupe said in I made a WireGuard package for pfSense:

                      Hello and I hope that you are safe and well. I compiled and built Lucasnz pfSense-pkg-wireguard-1.0.1 For 2.5.0. With all due respect to Ascrod and Ashus, I found Lucasnz to work perfectly on pfSense 2.5.0. For you to get a basic idea as to how to setup a FreeBSD 12 Build Server - see my old tutorial here :

                      I have pfSense 2.5.0 running on a SG-3100.

                      I did a system update tonight, and noticed there's a new wireguard-tools package:

                      https://forum.netgate.com/topic/155751/2-5-just-installed-a-new-wireguard-tools-package

                      Does anybody know what this is? Will it help to get Wireguard going?

                      T 1 Reply Last reply Reply Quote 0
                      • T
                        TidalWave123 @victorhooi
                        last edited by

                        @victorhooi that’s cool. So wireguard is under the package manager now?

                        Also curious for the developers. Does the wireguard package have the ability to use the local authentication server as a multi factor Authenticator?

                        I want to start using wireguard to stream PCoIP media streams over the WAN, but some of the big clients require two factor authentication.

                        Currently we are using OpenVPN (SSL+user authentication) so the certificate key is stored on the Remote Desktop. Then the user has to also authenticate with the username and password which is stored on the pfsense local database.

                        With wireguard I see a noticeable improvement in Single threaded WAN speeds from 50-100Mbps with OpenVPN tunnels to 200+Mbps with Wireguard connections - default settings on both protocols.

                        The PCoIP protocol might work with openVPN but it states it needs 100Mbps per client. Sometimes my OpenVPN clients only get 60Mbps for some reason. So I really want to upgrade my VPN architecture to wireguard.

                        However I won’t be able to use wireguard with our current security policy unless we can somehow integrate a user based authentication on top of the key string. I’ve read that it is possible to integrate a TOTP Authenticator which if we have to, we could install on the end users phones, but would rather use the local database for ease of deployment.

                        So anyways, I really appreciate all the work you guys do for the open source community. I support netgate. We have many SG-3100s in service.

                        Thanks for reading!

                        1 Reply Last reply Reply Quote 0
                        • MrGamecaseM
                          MrGamecase
                          last edited by

                          Ascord, Fantastic job with this thank you !!!

                          But I have a few issues though.. i can get my device to handshake with the 'Netgate Wireguard'. but i'm unable to access any of my servers on the lan .. am i missing really obvious something ?

                          1 Reply Last reply Reply Quote 0
                          • M
                            moelharrak
                            last edited by

                            Hi all,
                            Good Job , thank you.
                            I have a question about the package if it's only works as client or can work as a server too?

                            AshusA 1 Reply Last reply Reply Quote 0
                            • AshusA
                              Ashus @moelharrak
                              last edited by

                              @moelharrak There is not much difference in server vs client configuration, so in general, yes, it works. Server just has the listen directive to know on that UDP port it can receive communication through firewall. Client has to know ip and port, where to connect in endpoint directive. The connection is then managed by wireguard automatically.
                              https://www.wireguard.com/quickstart/#nat-and-firewall-traversal-persistence
                              https://docs.sweeting.me/s/wireguard#How-WireGuard-Routes-Packets

                              1 Reply Last reply Reply Quote 1
                              • A
                                alirz
                                last edited by

                                Anyone know if this wireguard setup keeps working after updating pfsence to 2.4.5_1?
                                Im currently on 2.4.5 and have no issues with wireguard. Just debating if i should update or not. Thanks.

                                D 1 Reply Last reply Reply Quote 0
                                • D
                                  dubatech @alirz
                                  last edited by

                                  @alirz Hi, I'm using it without any kind of problem, since the release of 2.4.5-RELEASE-p1.

                                  A 1 Reply Last reply Reply Quote 0
                                  • A
                                    alirz @dubatech
                                    last edited by

                                    @dubatech thanks, do you think if I upgrade from 2.4.5 to 2.4.5-1, I will have to reinstall and re-configure the wireguard?

                                    T 1 Reply Last reply Reply Quote 0
                                    • W
                                      wion
                                      last edited by

                                      Greetings to all! And immediately I apologize for my English. Dear Ascrod, the wireguard service does not start if I specify several Allowed IPs in the peer settings. If one is Allowed IPs, then the service starts.
                                      I'm using 2.4.5-RELEASE-p1 (amd64)
                                      FreeBSD 11.3-STABLE

                                      W 1 Reply Last reply Reply Quote 0
                                      • W
                                        wion @wion
                                        last edited by

                                        @wion

                                        @wion said in I made a WireGuard package for pfSense:

                                        Greetings to all! And immediately I apologize for my English. Dear Ascrod, the wireguard service does not start if I specify several Allowed IPs in the peer settings. If one is Allowed IPs, then the service starts.
                                        I'm using 2.4.5-RELEASE-p1 (amd64)
                                        FreeBSD 11.3-STABLE

                                        the problem was adding subnet 172.20.0.0/20. Until I changed the mask to / 16, the service did not work

                                        1 Reply Last reply Reply Quote 0
                                        • T
                                          Talisker @alirz
                                          last edited by

                                          @alirz You will have to reinstall the wireguard package, but not reconfigure the firewall.

                                          1 Reply Last reply Reply Quote 0
                                          • P
                                            pepe00
                                            last edited by

                                            I have upgraded to 2.4.5-p1, based on FreeBSD 11.3-STABLE.

                                            I have uninstalled the old version of wireguard, but cannot install the new one.

                                            I am trying to download "wireguard-go-0.0.20200320.txz" and "wireguard-1.0.20200513.txz" for FreeBSD: 11: amd64 without success.

                                            Could someone share it or upload it somewhere?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post