mirror of https://github.com/opnsense/docs
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
63 lines
2.5 KiB
ReStructuredText
63 lines
2.5 KiB
ReStructuredText
:orphan:
|
|
|
|
============================
|
|
WireGuard Site-to-Site Setup
|
|
============================
|
|
|
|
------------
|
|
Introduction
|
|
------------
|
|
|
|
WireGuard is a simple and fast modern VPN. It aims to be faster and simpler than IPSec. It intends to be
|
|
considerably more performant than OpenVPN. Initially released for the Linux kernel, it is now cross-platform
|
|
and widely deployable. It is currently under heavy development.
|
|
|
|
---------------------
|
|
Step 1 - Installation
|
|
---------------------
|
|
|
|
Install the plugin as usual, refresh and page and the you will find the client
|
|
via :menuselection:`VPN --> WireGuard`.
|
|
|
|
------------------------
|
|
Step 2 - Setup WireGuard
|
|
------------------------
|
|
|
|
The setup of a Site-2-Site VPN is very simple. Just go to tab **Local** and create a new instance.
|
|
Give it a **Name** and set a desired **Listen Port**. If you have more than one service instance be
|
|
aware that you can use the **Listen Port** only once. For **Tunnel Address** choose a new virtual
|
|
network to run communication over it, just like with OpenVPN or GRE (e.g. 192.168.0.1/24).
|
|
**Peers** can not be chosen yet since we have not created them yet.
|
|
After hitting **Save changes** you can reopen the newly created instance, write down your new public
|
|
key and give it to the other side.
|
|
|
|
When this VPN is set up on OPNsense only do the same on the second machine and exchange the public
|
|
keys. Now go to tab **Endpoints** and add the remote site, give it a **Name**, insert the **Public
|
|
Key** and the **Allowed IPs** e.g. *192.168.0.2/32, 10.10.10.0/24*. This will set the remonte tunnel
|
|
IP address (/32 is important when using multiple endpoints) and route 10.10.10.0/24 via the tunnel.
|
|
**Endpoint Address** is the public IP of the remote site and you can also set optionally the
|
|
**Endpoint Port**, now hit **Save changes**.
|
|
|
|
Go back to tab **Local**, open the instance and choose the newly created endpoint in **Peers**.
|
|
|
|
Now we can **Enable** the VPN in tab **General** and go on with the setup.
|
|
|
|
-----------------------
|
|
Step 3 - Setup Firewall
|
|
-----------------------
|
|
|
|
On :menuselection:`Firewall --> Rules` add a new rule on your WAN interface allowing the port you set in your
|
|
instance (Protocol UDP). You also have a new interace **Wireguard** in rules, where you can
|
|
set granular rules on connection inside your tunnel.
|
|
|
|
Your tunnel is now up and running.
|
|
|
|
-------------------------
|
|
Step 4 - Routing networks
|
|
-------------------------
|
|
|
|
If you want to route your internal networks via this VPN just add the network in the field
|
|
**Allowed IPs** in **Endpoints** tab (e.g. 10.0.1.0/24).
|
|
|
|
That's it!
|