WireGuard alternative AmneziaWG

elegantd

I think I know the answer as I already searched on the AmneziaWG website and found no explicit support for freeBDS. However, people are busy bees always doing something on GitHub. Is there a way to implement AmneziaWG on Pfsense?

Just a small excerpt from the website.

AmneziaWG maintains high performance while adding an extra layer of stealth, making it a superb choice for those seeking a fast and discreet VPN connection.

Features of AmneziaWG include:

Availability with AmneziaVPN on all platforms.
Low energy consumption.
Minimal configuration needed.
Undetectable by DPI analysis systems, resistant to blocking.
Operates over the UDP network protocol.

cosmoxl

@elegantd

I'd love to see this too. Tools that help bypass VPN restrictions are needed by some desperately.

elegantd

@cosmoxl That's makes at least 2 smart people. Well let's keep our fingers crossed.

MarvinFS

Count me in! But considering replies seems like it never gonna happen

Nan0tEch

Learned about AmneziaWG yesterday, this needs to be an option imho. Hope someone picks this up.

tty1

Just ported it to pfSense last week. Deployed it on a few firewalls already — running stable so far.

Binaries are here - https://github.com/track2/pfSense-Amneziawg/. Haven’t had time to write the docs yet, but I’ll try to put a proper README with installation steps and details soon.

In the meantime, feel free to DM me if you run into anything — I’ll do my best to help.

At the moment I’ve only built binaries for 2.7.0 and 2.7.2 since there wasn’t any demand for other versions yet. If needed, I can build those too.

elegantd

@tty1 That is beyond awesome! I would love to give it a try. Not going to lie been very busy. I will get to it though. Thank you very much. I was not really expecting anything to come from my message. I am glad I posted it now! Good job and much praise and thanks!

David

luckman212

Installing kernel modules from a random github repo with no source code or reproducible build steps, yep seems like a "smart" idea.

Also, I took a quick peek at the service rc script, those < and > definitely don't seem right...

e69cbc59-b680-4184-91d5-83bc4c6f9597-CleanShot 2026-05-24 at 18.11.44.png

elegantd

@luckman212 I was not going to blindly install. But I totally agreen with you. I was being positive and hopeful rather then skeptical and negative But you are absolutely right one should indeed be careful. Thanks for the warning.

tty1

You’re absolutely right — blindly installing random binaries is a pretty bad idea security-wise. That said, you can build the kernel module yourself; it’s not particularly difficult, just time-consuming. On my setup, building the kernel and the full environment inside a VM takes roughly 10 hours.

It’d actually be great if someone could reproduce the build, publish the checksums of the resulting binaries, and confirm there’s nothing extra injected on my side.

As for the rc script: I’m not using awg-quick (and intentionally didn’t publish it on GitHub), because all I really need is to bring the interface up and assign an IP. Routing and everything else I configure directly in pfSense itself.

The highlighted line is simply where you define the interface settings. The script creates the awg0 interface first, then loads the config file. Note that the address assignment line in the config is commented out since awg-quick is not being used:

#Address = YOU DON'T NEED TO SET IP HERE! Leave it commented

So everyone will end up with their own subnet/mask in the rc script, for example:

ifconfig awg0 inet 10.0.5.2/24 up

I run this script through the standard Shellcmd package (service awg start) using the earlystart option (that part is important). Otherwise, awg0 won’t exist yet when pfSense starts assigning interfaces, and the system may fail to boot properly because the previously assigned interface is missing.

To be fair, I never planned to make this a public release. I originally built it just for my own production use, so yeah, some parts are a bit rough around the edges. Maybe one day I’ll have time to clean it up properly — maybe even add a GUI (though realistically, probably not).

yon 0

https://redmine.pfsense.org/issues/16854

We need more support to add it, not to lower its priority.

yon 0

@tty1 Can I run it in PF plus v26.03 ?

yon 0

https://www.freshports.org/net/amnezia-kmod/

FreeBSD is officially available, is it usable?

tty1

@yon-0 No, according to this doc, pfSense Plus v26.03 is based on FreeBSD 16.0-CURRENT (branch plus-RELENG_26_03).
To build a module for a specific pfSense version, you need to first build the environment and kernel from source (https://github.com/pfsense/FreeBSD-src), and the branch has to match the version (as per the same doc).
https://github.com/pfsense/FreeBSD-src/branches/all — unfortunately, I don't see a plus-RELENG_26_03 branch here.
Building against plain FreeBSD 16.0 isn't a solution either — your module almost certainly won't load due to a kernel mismatch.

yon 0

@tty1

https://www.freshports.org/net/amnezia-kmod/

Is this usable?

tty1

@yon-0
Yes, it’s usable, but you have to build it with the specific kernel compiled from the corresponding sources. You also need to make sure you’re using the correct branch (you can find it here - https://docs.netgate.com/pfsense/en/latest/releases/versions.html).

I built it from here

Qtronix

@elegantd
Hi everyone,

Inspired by this thread and the growing need for obfuscated WireGuard tunnels on pfSense, I’ve put together an unofficial AmneziaWG Client Package developed and tested specifically for pfSense 2.8.1-RELEASE.

It’s built strictly for Client mode (connecting your pfSense router to a remote AmneziaWG server) and comes with native Web GUI integration.

Key Features:

Full Obfuscation Support: Configurable parameters for $J_c$, $J_{min}$, $J_{max}$, $S_1$, $S_2$, $H_1$–$H_4$.
User-land Engine: Uses the amneziawg-go backend for better stability across FreeBSD updates.
Native Web GUI: Manage your client tunnels directly from the pfSense web interface.
Target OS: Tested on pfSense 2.8.1-RELEASE.

Repository & Installation

You can find the source code, installation script, and usage details on GitHub:
qtronixx/pfSense-pkg-amneziawg-client

️ Important Disclaimer: This is a third-party, community-driven package and is not affiliated with or endorsed by Netgate. Because it modifies network configurations, please test it thoroughly on a staging VM or create a full configuration backup before deploying it on a production router.

Feedback, bug reports, and contributions are very welcome!

Qtronix

Hi everyone,

I’ve just released v1.0.1 of the pfSense AmneziaWG client package. This release addresses a critical issue that could cause pfSense to fall into a "Network interface mismatch" boot loop upon system restart.

Critical Fix: Interface Naming (awgX ➔ tunN)
During early boot, pfSense checks all configured interfaces in config.xml against physical interfaces detected in the system. Virtual interfaces are filtered out based on naming conventions — specifically, names starting with standard virtual prefixes like tun are recognized as virtual and skipped during physical link presence checks.

Because the plugin previously generated interface names with the awgX prefix, pfSense saw them as missing physical NICs during boot, triggering the "Network interface mismatch" panic prompt.

Fix: Interface names have been updated to use the standard virtual prefix tun (e.g., tunX).

How to Upgrade
Run the standard update command via SSH / Shell:

Bash
rm -rf pfSense-pkg-amneziawg-client
git clone https://github.com/qtronixx/pfSense-pkg-amneziawg-client.git && sh ./pfSense-pkg-amneziawg-client/install.sh update
️ IMPORTANT: Required Manual Action After Update

While the automatic migration renames records in tunnels.json and .conf files, pfSense cannot automatically re-assign interfaces in the main system settings. Please follow these steps after updating:

Go to Interfaces → Assignments.

Delete the old awgN entry from Assignments (if left orphaned).

Save / Apply changes (or click "Save" in the AmneziaWG GUI to run awg_sync_all()).

The new tunN interface will now appear in the available interface list — assign it.

Re-apply your Static IPv4 / Gateway / Firewall Rules / NAT settings to the new interface.

What else is new in v1.0.1?
Debug Log Toggle: Added a dedicated GUI checkbox under VPN → AmneziaWG → Tunnels to easily turn debug log messages on or off without editing plugin files.

Full release details on GitHub: Release v1.0.1

Thanks to everyone testing and reporting issues!

Qtronix

Hello again, everyone!

I’ve just released v1.1.0 of the pfSense AmneziaWG client package. Critical fix: tunnels now persist across system reboots

Key Fix

Tunnels no longer fail to start after a pfSense reboot. Prior to this release, AmneziaWG interfaces would start correctly via the web interface, but after a system reboot, they would remain in a "stopped" state and require manual activation.