WireGuard-Guide | WireGuard Guide | VPN library

Select Apps, then search for WireGuard and install Wireguard-Easy. Almost all of the settings can stay as default, however, there are a few that we will modify.
Set the WG_HOST variable to be the IP address of your Unraid server.
If you’d like to modify the WireGuard port (51820), you can do that here.
Change the default Web GUI password.
When looking at how to set up WireGuard on pfSense, the first thing that we need to do is install the package. Follow the instructions below to install the WireGuard package on pfSense.
Open the Package Manager and search for WireGuard, then Install the latest version of the package.
After the package has installed, select VPN then WireGuard and under the Tunnels section, select Add Tunnel.
In the Tunnel Configuration, set the Description as WireGuard, the Listen Port as 51820, then Generate private and public keys.
Copy the Public Key. We will need this for our client configuration.
Create the tunnel, then select Settings, and ensure that Enable WireGuard is selected. Then Save and Apply.
In your router’s webUI, navigate to System - Software, click Update lists:. In the Filter field, type WireGuard, locate and install the wireguard, wireguard-tools, kmod-wireguard, and luci-app-wireguard packages. Note: The wireguard package is included in version 22.02.
WireGuard route all traffic through wireguard tunnel
Automated WireGuard Server and Multi-client
WireGuard basics
WireGuard client
WireGuard extras
WireGuard performance
WireGuard Road-Warrior Configuration
WireGuard
WireGuard server
WireGuard peers
Automated WireGuard site-to-site VPN configuration
Name - give it any name
Protocol - WireGuard VPN
Bring up on boot - Checked
Private Key - copy and paste the generated previously Private key
IP Address - enter the WireGuard IP Address obtained in the Client Area ending with /32, e.g. 172.27.124.169/32
Name - Give it any name
Input - Reject
Output - Accept
Forward - Reject
Masquerading - Checked
MSS clamping - Checked
Covered networks - select the previously created VPN tunnel interface
Allow forward to destination zones - Unspecified
Allow forward from source zones - lan
172.16.0.1 = regular DNS with no blocking
10.0.254.2 = standard AntiTracker to block advertising and malware domains
10.0.254.3 = Hardcore Mode AntiTracker to also block Google and Facebook domains
A device reboot is not required, though it may be useful to confirm that everything behaves as expected.
Run a leak test at https://www.dnsleaktest.com via one of the internal network clients attached to your OpenWRT router.
After installing WireGuard, do not start it yet. We need to configure a few options first. This is where you’ll create WireGuard configuration files for each of the devices you want to connect to WireGuard with. For this example, I’m using my phone and leaving allowed_ips and client_allowed_ips as is. If you adding multiple devices, then you’ll need to copy the entire block of code starting at name, give it a different name, and add the next available IP address (For example: 172.27.66.4). Click Save once finished. Then, go back to the Info tab and click Start. The next step is to forward port 51820 from your Home Assistant server through your router. Unfortunately, there are so many different types of routers, each with different steps to port forward. The important thing to note is that you’ll be port forwarding 51820(wireguard port) from the internal IP of your Home Assistant instance (for example: 192.168.68.24) and choosing the UDP protocol only. Download the WireGuard app from the Apple App Store or Google Play Store. You will need it for the next step. If all goes well, you can click into the new tunnel connection from within the app. If you see data flowing under the Transfer section, that means you are good to go. Once you have everything setup and working correctly, you should read through the WireGuard Addon docs to setup up allowed_ips and client_allowed_ips to further secure your VPN instance. There’s also some other helpful options you can configure such as log level, but these are all optional.
Next, open up Home Assistant. Go to Supervisor > Add-on store, and search for WireGuard.
Click the WireGuard addon, and the click Install.
Click the Configuration tab at the very top.
There are two blocks of code here: server and peers. The server section is the WireGuard server info, and the peers section is where you’d add new devices that will connect to your VPN.
Host: add the subdomain you just created. (vpn.mydomain.com)
Addresses: If your internal network is using the 192.168.x.x or 10.x.x.x range, you can leave the default IP addresses WireGuard has provided. (see note above)
DNS: Set to your router’s internal IP address (Open CMD > ipconfig /all > Under DNS servers) If you have Adguard or PiHole installed, you can use the IP address of those instead. This will allow you to block ads even when connected to the WireGuard VPN.