Thanks for your time and effort. How do we get this as an official package?

@marcelomayo74 thank you very much for working on open source software.

Perhaps this could become an official package for pfSense, if you were to agree?

I went back over the form field by field looking for gaps.

The endpoint port is now mandatory. wg(8) parses Endpoint as
host:port and refuses a client file that has no port — the phone apps just
say the QR code is invalid. The field is pre-filled from the tunnel's listen
port, but if you cleared it the peer used to save anyway and produced a file
no client would accept. It's now rejected with a message. Peers already saved
without a port fall back to the tunnel listen port when their file is rebuilt,
so nothing that already works stops working.

A new client starts from the last one created on that tunnel. Endpoint,
port, DNS servers, MTU, keep alive and the routing preset are carried over, so
the second phone in a household doesn't mean typing the same six fields again.
The address and the key pair are always new, and split tunnel is recomputed
rather than replayed — if you changed the tunnel network or added a LAN, you
get the networks as they are now, never a stale list. Each tunnel remembers on
its own, and switching the tunnel dropdown applies that tunnel's settings in
place.

The MTU comes from the tunnel. If the tunnel doesn't run on the 1420 every
client already assumes — a PPPoE WAN, say — the client file now says so
instead of leaving the client to guess.

Firewall aliases can be used for Tunneled Networks. Pick a host or network
alias and its addresses are dropped into the field. They're resolved at that
moment, since WireGuard has no idea what an alias is, so editing the alias
later doesn't reach clients you already handed out.

Also fixed: opening an existing peer now always shows what that peer was saved
with, blank fields included, so the carry-over above can't leak another
client's MTU or DNS into it.

Tested on pfSense CE 2.8.1 with pfSense-pkg-WireGuard 0.2.9_6, and on 2.9.0-BETA
(amd64) with pfSense-pkg-WireGuard 0.2.13_4.

How to install it, step by step

You need the .pkg file from the release page:
https://github.com/MarceloMayo74/pfsense-wgeasy/releases/latest

Replace 192.168.1.1 below with your firewall's address, and admin with your
firewall's login user if it's a different one.

Option A — from a terminal (three commands)

SSH has to be enabled first: System → Advanced → Admin Access → Secure Shell →
Enable Secure Shell.

Windows 10/11 already ship scp and ssh; open PowerShell. On macOS or Linux,
open Terminal. Run these from the folder where you downloaded the file, or write
the full path to it.

1. Copy the package to the firewall:

   scp pfSense-pkg-wgeasy-0.4.2.pkg admin@192.168.1.1:/root/
   

2. Install it:

   ssh admin@192.168.1.1 "pkg add /root/pfSense-pkg-wgeasy-0.4.2.pkg"
   

   If you already have an older version, delete it first — pkg add will not
   upgrade in place:

   ssh admin@192.168.1.1 "pkg delete -y pfSense-pkg-wgeasy && pkg add /root/pfSense-pkg-wgeasy-0.4.2.pkg"
   

   Your peers survive that. They live in config.xml, not in the package.

3. Delete the copy you uploaded, so it doesn't pile up on the firewall:

   ssh admin@192.168.1.1 "rm -f /root/pfSense-pkg-wgeasy-0.4.2.pkg"
   

Option B — from the web GUI, no terminal at all

1. Go to Diagnostics → Command Prompt.

2. In the Upload File box at the bottom, pick the .pkg and upload it. It
   lands in /tmp/.

3. In the Execute Shell Command box at the top, run:

   pkg add /tmp/pfSense-pkg-wgeasy-0.4.2.pkg
   

   Upgrading from an older version instead:

   pkg delete -y pfSense-pkg-wgeasy && pkg add /tmp/pfSense-pkg-wgeasy-0.4.2.pkg
   

4. Optional cleanup, in the same box:

   rm -f /tmp/pfSense-pkg-wgeasy-0.4.2.pkg
   

What you should see

pkg add will warn that the package doesn't come from a repository. That's
expected — it isn't in the official repo or any unofficial one.

When it's done, the menu entry is at VPN → WireGuard Easy. If the menu
doesn't show up right away, reload the page.

To remove it later:

pkg delete -y pfSense-pkg-wgeasy

That leaves your peers alone: they were created through the native WireGuard
package and stay under VPN → WireGuard → Peers.

Your peers survive that — they live in config.xml, not in the package.

Release and changelog: https://github.com/MarceloMayo74/pfsense-wgeasy/releases/tag/v0.4.2