Not an entirely clear what is going and what hosts you are trying to connect. I think you should point out that you are connecting one peer to another. This video is nice but far from a clear explanation. You are taking advantage of your extensive (implied) knowledge and assuming this without explicitly making that clear. I see you have a relatively clearer description on the webpage.
Excellent tutorial... thank you very much, it has helped me a lot; i managed to connect my android phone with my PFSENSE. Despite not understanding much English (besides, you speak very fast, hahaha), with the youtube subtitles and the examples in the video they helped me to achieve my goal. An affectionate greeting from Punta Arenas - Chile.
I used the user manual and suffered a little until I realized what was what. Therefore, I love to watch videos in which they show all the steps that are needed and without unnecessary actions)) Thank you for the video.
Just wanted to say that I've been struggling with getting Wireguard set up (on and off) for at least a year. Followed this guide and its been running perfectly for the last two days! Love all of your content and guides and not sure why I didn't think of following this one earlier. Thank you so much!!!!
Thank you Tom! I'm used to follow you but for this setup I followed another youtuber's tutorial... and didn't work. returned here and now I have it working. you are the best!
what I used to do was simply remote SSH to my SSH server on my home network using putty... and set the putty client to forward ports of particular interest... My internal home devices all had static IPs so I always knew what IP address and port I wanted to forward.... was that bad or insecure?
Man, I love your channel but this video has just solidified it. Simple, thorough explanation for how to set up pfSense Wireguard. Ive been working on this for awhile and didn't fully understand WG, but you fixed that for me! Love it. Cant upvote enough. Thank you!
7:33 - in video there is option to add interface configuration which is slightly different on new versions, and if you have already created and linked an interface. to create an interface, first create the tunnel and save (As per video) then: Interface -> Assignments -> under Available networks drop-down, should have 'tun_wg0(tun_wg0)' as option Fill in details as per the interface section in the video.
Didnt work for my iPhone, watched the video 5 times now and even exported the config file from pfsense and uploaded it to Wireguard app on iPhone. I'll probably have to do IPsec. Have had problems with both openvpn and wireguard.. Would love a IPsec tutorial that will work for Apple devices, eg iPhone, iPad and Mac.
Hi ! Say I have a local router that can handle a Wireguard config. I am not able to modify the local LAN network config so my local router is a passive gateway in order to juste be able to connect to this network from outside (with a 4G connection). I would like to be able to reach a local resource with NAT rules over using wireguard through my local router, is it possible ?
Hey Tom, just want to start with a huge thank you for the hours of content you put on here, it's not only entertaining but extremely helpful! I don't know if it's a bug, but I was struggling to connect a windows client over a mobile hotspot. I was getting constant log entries of handshakes did not complete. The configuration was confirmed as working when importing onto an android device but refused to work in the windows wireguard. The solution was to create a NAT from WAN to localhost (with the associated firewall rule), instead of the single rule (WAN allow UDP port...) within the firewall rules. I hope that makes sense?
Hello Lawrence, I just wanted to say you're a great network teacher! I use to have a edgerouter and switched to pfSense because of your knowledge and videos. I'm new to pfSense and can't decide which VPN server I would like to run on pfSense. I just need the VPN to access my LAN when I not home. So is wireguard faster than openVPN? Thank you in advance.
Nice video mate. Keep it up I do have a question my pfsense wireguard was hosted on a cloud Vultr.. Im concerned that my download and upload speed is bad less than 10Mbps.. I already disabled the Hardware Checksum Offloading Hardware TCP Segmentation Offloading but still getting slow results.. Any ideas?
I have two troubles with this still: (1) the standard setup stuff seems to work well on Android phones, but never seems to work for iPhones. Has anyone run into this? and (2) I run a local DNS Unbound Resolver and block all other DNS outbound. But having a lot of trouble getting devices that connect in via Wireguard to get their DNS from Unbound on the pfsense. Any ideas?
Good day sir! would like to ask how did you get the package its because i installed the package however its only EXPERIMENTAL.. i dont have the 2 package below or i think its not complete
Hi There, Great video as usual. Running pfsense 2.6.0 with wireguard VPN. I have successfully setup my windows, mac and linux devices. I'm trying to configure my Pixel 6 android phone that runs version 13 and it never connects. and ideas on what to look at? thanks
Is it better to run Wireguard on my Netgate 1100 as the pfSense package, or using PiVPN on a separate Raspberry Pi? Other than eliminating the Added Pi device are there other benefits? PiVPN is much easier to set up with the QR code profiles. I am curious which would perform better.
Im new to VPN. I am setting up remote access for staff to RDP to computers inside the private network behind the pfsence. Do I have to create a peer entry for each remote user and generate a public key on each remote device, ie laptop or iPad etc?
@@ViktorWingqvist Nope, I could probably update my host file on the local machine to work that way but I never had any luck using my PFSense DNS over WireGuard.
Thanks Tom; I hope this gets more straightforward as it gets to the production version. My brain is spinning having watched this! Is there a major speed increase for remote users dialling to WG, versus oVPN?
Wireguard is significantly faster, reaching almost native IPSec speeds, but it lacks other features like user management and centralized control. Each user would have to configure their wireguard with your server information, provide you a public key, and then you'd have to add that to the server. Whereas in OpenVPN you just send people a certificate they add.
@@icedutah lol no...imagine talking end users into copying/pasting the key and some include white spaces. Or they put in the wrong IP. Or you just want to know at what time a user logged into the VPN - there is no way to find out. Thats why other vendors, PIA or Nord, implement their custom user authentication overlay because wireguard is just a protocol at the end of the day.
This helped a lot! I accidentally pasted the wrong public key into my Ubuntu and nothing worked. After looking for 30 minutes I thought about every step again and found the error. Now it's working :)
We're scoffing at shoulder surfing and people being able to remember character strings but everyone has a camera built into a cell phone that's permanently attached to their hand.
Thank you very much for this video. Used it to connect my phone to pfsense. Messed up typing the keys manually the first time... and set the video playback at .75 speed to catch all that was said.
Hey matee, very grateful for the videos, congratulations, but I have a doubt, can you tell me that there is a difference in speed between point-to-point open vpn and remote client access? Big hug!
Anyone having issues with your clients not connecting to the pfSense? Receiving Handshake for peer did not complete? Try using a different port other than 51820 or 51420. I used ones that are already allocated for different services (Port 500) and it started working. Turns out my ISP is blocking UDP traffic on 51820/51420. I also tried things like port 52 and it still blocked it. I changed it to 53 and everything started working. I changed it to 500 as I didn't like the idea of using the DNS port. Hopefully this saves someone some frustration in the future.
Excited to replace my home router with a custom built one running pfsense. I was just in the process of figuring out what VPN to use and this popped up in my feed. Thanks for sharing!!
Thanks for the great video! This got me going in under an hour when I had to leave town and really needed to have access to my home network while gone. Your vids are really easy to follow and extremely helpful
thank you. I have a request ... Some sites are filtered for my country. I am going to connect my pfsense to external vpn service that I have on a server in America, and the traffic of sites that are filtered will pass through this way. how can i do ? please ...
Tom - Thanks again for another great video. I'll definitely refer back to this when I need to set up external access. Not sure if you're planning on releasing a video similar to Christian's about setting up Wireguard access to a VPN provider (or at least troubleshooting steps), but I've been having at least one strange issue there. I've got the Wireguard tunnel set up and peer added for the endpoint (Sweden, for example) and all the traffic is passing fine. However, if I modify the same peer to go to a different location, like Mexico, Wireguard seems to hold on to the old peer information and connects to Sweden again. I've tried restarting Wireguard and the appliance, enabling/disabling the WG interface, but nothing seems to drop that hold aside from making a new peer from scratch. It's not a huge issue, since all the traffic is still going out encrypted, but I'm used to simply changing the OpenVPN endpoint and it going to the new location without hassle. Any thoughts on what might cause this or how to mitigate it? Thanks so much!
so you have to set up a peer for every host on the network? with openvpn, I can use my phone to get to any device on my network, no configuration needed on the clients except to let me in the front door. is that not possible with wiregaurd?
I have installed the WireGuard "server" on my pFsense 5100 and the clients on my Windows laptop and iPhone. Both clients can connect to my pFSense 5100 from outside of the network. However, I cannot or ping to any service or device internal or external on or by way of the pFsense. For example, I cannot connect to ping my printer or file server from outside of the network. I configured pfsense ,laptop and iPhone multiple times and still the same symptoms. Where should I focus my debugging? Just to confirm the client ip ARE X,X,X,Y/32
I installed WireGuard on a NETGATE SG-1100, configured everything, just as I did on a SG-3100. On the 1100, I get a message stating, The WireGuard service is not running. Okay! How do I make it run?
once the wg server end point times out - without using keep alive - does it reestablish the link once traffic to one of the allowed networks is detected? eg, client attempt to access a remote file share. Just trying to determine if the end user has to reconnect the VPN manually, or if it just reestablishes it on it's own?
for your site to site vid coming up - it may be worth mentioning that there's this glaring bug under the hood with pfsense which netgate is saying is a bsd issue preventing people from opening a port on the far end of a site to site tunnel and trying to do port forwarding across the tunnel. the return traffic will get sent out the default gateway, not back across the vpn link. I have had to do super gross, dumb, hacky things to get around this, but its probably worth mentioning! :D
Don't know if it's bug in pfSense 2.6 or something on my side but I can't use a pre-shared key. I can generate it but the copy link is bugged and nothing gets copied so I don't know what it is. Still it works at least with just the public key.
Maybe a solution? VPN wireguard key no copy issue- Go into the VPN/WireGuard/Settings and disable the "Hide" options. This will let you see and copy the Pre-shared Key.
Do you have a guide/video on not having any internet once wireguard connects? I've tried everything and I'm still struggling... Keys are correct, I've checked tx and rx, I've checked endpoints, dns and more. Still no internet once connected...
Hi. I might have a stupid question. I get the tunnel/handshake established and FW rule done. But no traffic is routed anywhere. Do you have an idea where to start troubleshooting?
This is awesome. I needed this as I'm getting back into pfsense again. Played from 2016ish to Dec 2019 with a functional machine as my home router. I moved right before Covid and didn't have control over the internet in the new place. Anyways, I'm just a novice enthusiast user and I'd like to request for your "pfsense to pfsense" video... one of my main goals was to build a portable pfsense (with AP) box I could plug in at a family member's/friend's house or hotel that connects to my home pfsense (via VPN), ideally automatically, so its just like I'm on my home network and have access to everything without having to configure all my traveling devices individually (which I don't mind doin). But would love that all-in-one solution partly to build and learn but also convenience or to get around hotel restrictions/control. Thanks for all the info and tutorials on pfsense you provide to the community :)
Can you dumb this down a bit? I would like to assume I'm pretty tech savy but I still can't get this to work, you make some assumption that people will just know certain things or say i made a video about it without referencing a video. Im just really frustrated trying to get this to work i appreciate the video but jesus christ can i feel like a watched a video explaining something without actually conveying anything.
Not sure what part you did not understand, but I have a getting started with pfsense here ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-fsdm5uc_LsU.html
@@LAWRENCESYSTEMS It was a long night sorry for being rude I wasn't really stuck on the pfsense bit I was stuck on the wireguard bit and setting up a peer. This was really different from when I setup a wireguard server so I don't know the exact time stamp in the video but it was around the midpoint where you went into the debian peer and said you had another video explaining how it was setup that i couldn't find (the other video).
Thanks for the great video. We are trying to have remote servers (running as WireGuard clients) act as back up targets. The server connect fine and have no issues talking from the remote location in. Ping works from local lan but we cannot establish any real bidirectional traffic. Is there rooting magic or gateway required like a site to site vpn?
@@LAWRENCESYSTEMS Hopefully a QR code/download config option will be available soon. Currently the process is rather manual and the Netgate docs are not the best either.
Thanks Tom. Another great tutorial. Is there a way to introduce some form of 2FA into the remote connection? Just concerned about remote users connecting from home and their home network is compromised. At least Openvpn allows for a password prompt?
