HowTo: OPNsense using Wireguard with IPv6 support

[OPN-UserGuide 2]

This is an updated version of this guide. I hope it gets moved soon to the guides section.

This guide should be complete now, but please note that the IPv6 port forwarding might not be 100% complete. Any advice is appreciated.
 

Disclaimer

In general, DO NOT TRUST ME! I'm not a security expert. I do not know what I'm doing here! 

This guide is based on:

• OPNsense 24.7.12_4-amd64

• FreeBSD 14.1-RELEASE-p6

• OpenSSL 3.0.15

Update: 2025-03-27: I updated to the latest version and this Guide is still correct

 

• OPNsense 25.1.4_1-amd64

• FreeBSD 14.2-RELEASE-p1

• OpenSSL 3.0.16

It should work in previous and future versions of OPNsense, but I can't guarantee it

This guide is based on the official Instructions but required modification: https://docs.opnsense.org/manual/how-tos/wireguard-selective-routing.html
it is also based on this guide. It's however not 100% correct, so I adjusted base on the official OPNsense guide and included the IPv6 setup. This is why I started a new guide instead of altering my previous one, inspired by the original Sj0r guide.

1. Preparation (not required if you access the firewall from LAN)

Some advice here… Opening the WAN interface to allow administration is not good! I am doing this because the firewall sits in my private LAN, and I'm not doing any port forwarding on my main router ! If your firewall is connected directly to the internet, do not do this!
Again, in general, DO NOT TRUST ME! I'm not a security expert. I do not know what I'm doing here!

Now that you know it…

1.1 Deselect “Block private networks” and “Block bogon networks” in Interfaces → WAN. After doing so: hit save and “Apply changes”.


1.2 Select "Disable reply-to" in Firewall → Settings → Advanced. Hit save at the end.


1.3 Add incoming WAN rule to allow administration. Go to Firewall → Rules → WAN

Add a TCP rule from "WAN net" to "This Firewall" on HTTPs.

2. Information gathering.

We'll grab some info that we need to configure the WireGuard Tunnel.
 

2.1 Login to the AirVPN Website.
2.2 Got to VPN Devices.
2.3 Add a new device.
2.4 Go to Config Generator.
2.5 In "Choose your OS" select "router".
2.6 In "Choose protocols" select "WireGuard.
2.7 In "Choose your device/connection" Select the device you have created in 2.3
2.8 Select your country under "By Countries". I selected Germany this time.
2.9 Scroll way down and download your config.

This is an example of a WireGuard config:
(the keys and IP are random and will not work, use your own)

[Interface]
Address = 10.10.10.10/32
PrivateKey = X72xgdx23XDomnSXmcy#S4Jc#9Y5G*vU$wg^n499yn6
MTU = 1320
DNS = 10.128.0.1

[Peer]
PublicKey = VTSQ77Uk4^&RY4h%S$#9h8PR2T&xyya&yPTtk6oD^m$
PresharedKey = b7&&7bntmCS5q%&4J*mSKBAUvV4XEqHerwscvbappXQ
Endpoint = nl3.vpn.airdns.org:1637
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 15

 

3. Setup IPv6 base configuration on your LAN.

We need to ensure that IPv6 communication is working on your LAN interface before we establish the VPN tunnel. Please note that I do not have an IPv6 address configured on my WAN interface to be distributed to LAN for security. Instead, I use a ULA address on the LAN. For those who do not know what ULA addresses are, these are the IPv6 equivalent to IPv4 private addresses like 10.x or 192.168.x. They are only routable on the LAN, and you will not be able to use them to reach an IPv6 destination on the internet.

3.1 WAN

3.1.1 Go to Interfaces → WAN

The WAN interface looks like this:

3.2 LAN

3.2.1 Go to Interfaces → LAN

The LAN interface looks like this in the upper section:


Now we set up the IPv6 Configuration.

3.2.2 generate yourself a ULA address using this site: https://unique-local-ipv6.com/
3.2.3 Enter the IPv6 network you have generated into the “IPv6 address” field and add “::1” at the end.



Hit Save.

3.3 LAN DHCP IPv6

3.3.1 Go to Services → ISC DHCPv6 → LAN
3.3.2 In the Range section under from add your IPv6 network address from 3.2.2 and add a “::1000” to the end. In the to section, add your IPv6 network address again and this time add a “::2000” to the end.



Hit Save at the bottom of the page.

3.4 Router advertisement

3.4.1 Go to Services → Router Advertisement → LAN
3.4.2 Set Router Advertisements to Managed



Hit Save at the bottom of the page.
 

3.5 Test IPv6 configuration

Now you should test if you can ping the OPNsense firewall IPv6 address from the LAN.

3.5.1 Connect a client to the LAN
3.5.2 On Linux or Windows, open a terminal and type ping -6 and the IPv6 from 3.2.1 ending with ::1 like “ping -6 fd2d:7173:d519::1”.
 

This needs to be successful! If this is not successful, fix it! Only continue once this is successful!!!

 

4. WireGuard configuration.

In the current Version of OPNsense you do not need to install the WireGuard plugin, this is already installed.

4.1 Peer configuration

 
4.1.1 in OPNsense go to VPN → WireGuard → Peers.
4.1.2 Create a peer with the following information:

4.1.3 Name: wg_airvpn_<country code>. Mine is called WG-AirVPN-DE
4.1.4 Public key: <PublicKey under heading [Peer] of your generated WG Config>
4.1.5 Pre-shared key <presharedKey under heading [Peer] of your generated WG Config>
4.1.6 Allowed IP's: 0.0.0.0/0 and ::/0 for IPv6 support
4.1.7 Endpoint Address: <Endpoint under heading [Peer] of your generated WG Config>
4.1.8 Endpoint port: 1637 (default port)
4.1.9 Keepalive interval: 15 (default interval)


 

4.2 Instance configuration

4.2.1 In OPNsense go to VPN → Wireguard → Settings → Instances
4.2.2 Create an instance with the following information:

4.2.3 Enable Advanced Mode. (upper left corner)
4.2.4 Name: <Endpoint Name i.e. WG-Inst-AirVPN-DE>
4.2.5 Private Key: <PrivateKey under heading [Interface] of your generated WG Config>
4.2.6 MTU: 1320
4.2.7 DNS servers <DNS Servers of your generated WG Config>
4.2.8 Tunnel Address: <Address including /32 under harding [Interface] of your generated WG Config>
Please review the screenshot below. For IPv6 add the given address and instead of /128 chose /64 to reach the gateway for gateway monitoring.
4.2.9 Peers: <select peer that you created with step 4.1>
4.2.10 Disable routes: Enabled.
4.2.11 Gateway: 10.128.0.1

Hit Save


 

4.3 Enable WireGuard configuration

Go to VPN → WireGuard → Instance and click on "Enable WireGuard"

 

4.4 Assign WireGuard Interface

 

4.4.1 in OPNsense go to Interfaces → Assignments
4.4.2 You'll find a “wg0(WireGuard - WG-Inst-AirVPN-DE)” (or similar) interface.
4.4.3 Type a Description, I've picked “[IntAirVPNDE]” and click Add.

4.5 Enable the Interface

4.5.1 Interfaces → Assignments → [IntAirVPNDE]

4.5.2 Enable: Enable the Interface.

No further configuration required. Ensure the “Block private networks” and “Block bogon networks” options are not selected, as shown below.

 

4.6 Create a gateway - IPv4

 

4.6.1 In OPNsense go to System → Gateways → Configuration
4.6.2 Add a Gateway with the following information:
4.6.3 Name: GW-AirVPN-DE-v4
4.6.4 Interface: Select IntAirVPNDE as created in step 4.4
4.6.5 Address Family: IPv4
4.6.6 IP address: 10.128.0.1
4.6.7 Far Gateway: Enabled
4.6.8 Disable Gateway Monitoring: Disabled.
4.6.9 Monitor IP: 10.128.0.1

4.7 Create a gateway - IPv6

4.7.1 In OPNsense go to System → Gateways → Configuration
4.7.2 Add a Gateway with the following information:
4.7.3 Name: GW-AirVPN-DE-v6
4.7.4 Interface: Select IntAirVPNDE as created in step 4.4
4.7.5 Address Family: IPv6
4.7.6 IP address: fd7d:76ee:e68f:a993::1 (use the IPv6 DNS server from the WG Config)
4.7.7 Far Gateway: Enabled
4.7.8 Disable Gateway Monitoring: Disabled.
4.7.9 Monitor IP: fd7d:76ee:e68f:a993::1 (same as 4.7.6)

5. Alias

Create at least one alias for the DNS configuration to prevent DNS leaks. You might want to create a separated alias for clients you want to run through the VPN, but as I do not need this, I skip it. The idea of how to set this up is similar.
Please note for DNS leaks, there are multiple ways to prevent DNS leaks. I tested mine using ipleak.net and dnsleaktest.com. There is also a complete section about dealing with DNS leaks in the OPNSense guide.

5.1 Alias setup

5.1.1 Create the DNS alias. Firewall → Aliases
5.1.2 Click add
5.1.3 Enable: selected
5.1.4 Name: VPN_DNS_Server
5.1.5 Type: Host(s)
5.1.6 Content: 10.4.0.1, 10.128.0.1, 10.5.0.1, 10.7.0.1, fd7d:76ee:e68f:a993::1


 

5.2 Forward all DNS queries to the VPN DNS servers

This might collide if you got clients on your LAN which should not go through the VPN, so this might need adjustments then.

5.2.1 Go to Firewall → NAT → Port Forward and click "+" to add a new rule.
5.2.2 Interface: LAN
5.2.3 TCP/IP Version: IPv4+IPv6
5.2.4 Protocol: TCP/UPD
5.2.5 Source: LAN net
5.2.6 Destination: Any
5.2.7 Destination port range: from: DNS to: DNS
5.2.8 Redirect target IP: VPN_DNS_Server (the Alias created in 5.1)
5.2.9 Redirect target port: DNS
5.2.10 Description: Redirect DNS requests from LAN to VPN DNS servers
5.2.11 NAT reflection: Disabled
5.2.12 Filter rule association: None

6. Outbound NAT

6.1 Switch to hybrid rules

6.1.1 Go to Firewall → NAT → Outbound
6.1.2 Select "Hybrid outbound NAT rule generation"
6.1.3 Click Save then apply the change


 

6.2 Add IPv4 outbound rule

6.2.1 Click the "+" to add a new rule
6.2.2 Interface: IntAirVPNDE (the interface created in 4.4)
6.2.3 TCP/IP Version: IPv4
6.2.4 Protocol: Any
6.2.5 Source address: LAN net
6.2.6 Source port: Any
6.2.7 Destination address: Any
6.2.8 Destination port: Any
6.2.9 Translation / target: Interface address
6.2.10 Pool Options: Default
6.2.11 Description: LAN to AirVPN-DE IPv4



 

6.3 Add IPv6 outbound rule

6.3.1 Click the "+" to add a new rule
6.3.2 Interface: IntAirVPNDE (the interface created in 4.4)
6.3.3 TCP/IP Version: IPv6
6.3.4 Protocol: Any
6.3.5 Source address: LAN net
6.3.6 Source port: Any
6.3.7 Destination address: Any
6.3.8 Destination port: Any
6.3.9 Translation / target: Interface address
6.3.10 Pool Options: Default
6.3.11 Description: LAN to AirVPN-DE IPv6



 

7. LAN to VPN firewall rule

With this rule, we point all LAN clients through the VPN.
 

7.1 IPv4 LAN to VPN rule

7.1.1 Go to Firewall → Rules → LAN and click on the "+" to add a new rule
7.1.2 Action: Pass
7.1.3 Quick: Apply the action immediately on match. (make sure it's enabled, as shown in the screenshot)
7.1.4 Interface: LAN
7.1.5 Direction: In
7.1.6 TCP/IP Version: IPv4
7.1.7 Protocol: Any
7.1.8 Source: LAN net
7.1.9 Destination: Any
7.1.10 Description: LAN to VPN IPv4
7.1.11 Gateway: GW-AirVPNDE-v4 - 10.128.0.1 (Created in 4.6)




 

7.2 IPv6 LAN to VPN rule

7.2.1 Go to Firewall → Rules → LAN and click on the "+" to add a new rule
7.2.2 Action: Pass
7.2.3 Quick: Apply the action immediately on match. (make sure it's enabled, as shown in the screenshot)
7.2.4 Interface: LAN
7.2.5 Direction: In
7.2.6 TCP/IP Version: IPv6
7.2.7 Protocol: Any
7.2.8 Source: LAN net
7.2.9 Destination: Any
7.2.10 Description: LAN to VPN IPv6
7.2.11 Gateway: GW-AirVPNDE-v6 - fd7d:76ee:e68f:a993::1 (Created in 4.7)



 

7.3 Block all other traffic rule

This ensures that all other traffic is blocked. It's not really needed but gives me a better feeling. It will collide if you got clients on your LAN which do not run through the VPN.

7.3.1 Go to Firewall → Rules → LAN and click on the “+” to add a new rule
7.3.2 Action: Block
7.3.3 Quick: Apply the action immediately on match. (make sure it's enabled, as shown in the screenshot)
7.3.4 Interface: LAN
7.3.5 Direction: In
7.3.6 TCP/IP Version: IPv4 + IPv6
7.3.7 Protocol: Any
7.3.8 Source: LAN net
7.3.9 Destination: Any
7.3.10 Description: Block all other traffic LAN to VPN IPv6
7.3.11 Gateway: default




Make sure these new rules are on top of the LAN firewall rules. If they are not, traffic might go through other rules and not through the VPN.


 

8. Port Forwarding for applications like BitTorrent

If you want to make one or more clients reachable from the internet, like you need to do when you are doing file-sharing, follow the below to make it work for Pv4 and IPv6.

Please note that this is confirmed to working with IPv4, but I'm not 100% sure how to make this fully work with IPv6. You can use an IPv6 port testing tool to confirm that the port is indeed open, but not many IPv6 clients really manage to connect to me. There must be something else I'm missing here. Please help me to get this right so we can complete this guide. So far, this functionality is limited.

Ensure that you got the Port Forwarding properly configured in the AirVPN Member section. You need a port from the :1 pool and this port needs to be forwarded to the device configured in 2.3
 

8.1 Setup IPv4 Firewall rule for incoming connections

8.1.1 Go to Firewall → Rules → IntAirVPNDE
8.1.2 Action: Pass
8.1.3 Quick: Apply the action immediately on match. (make sure it's enabled, as shown in the screenshot)
8.1.4 Interface: IntAirVPNDE
8.1.5 Direction: In
8.1.6 TCP/IP Version: IPv4
8.1.7 Protocol: TCP/UDP
8.1.8 Destination: *the IPv4 address of your client*/32
8.1.9 Destination port range: *your port*
8.1.10 Description: YourRule IPv4
8.1.11 Advanced features: Enabled
8.1.12 reply-to: GW-AirVPN-DE-v4 10.128.0.1





 

8.2 Setup IPv6 Firewall rule for incoming connections

This is equal to the 8.1 setup. Differences are marked bold:

8.2.1 Go to Firewall → Rules → IntAirVPNDE
8.2.2 Action: Pass
8.2.3 Quick: Apply the action immediately on match. (make sure it's enabled, as shown in the screenshot)
8.2.4 Interface: IntAirVPNDE
8.2.5 Direction: In
8.2.6 TCP/IP Version: IPv6
8.2.7 Protocol: TCP/UDP
8.2.8 Destination: *the IPv6 address of your client*/128
8.2.9 Destination port range: *your port*
8.2.10 Description: YourRule IPv6
8.2.11 Advanced features: Enabled
8.2.12 reply-to: GW-AirVPN-DE-v6 fd7d:76ee:e68f:a993::1
 

8.3 Port Forwarding IPv4

8.3.1 Go to Firewall → NAT → Port Forward, click “*” to create a new rule
8.3.2 Interface: IntAirVPNDE
8.3.3 TCP/IP Version: IPv4
8.3.4 Protocol: TCP/UDP
8.3.5 Destination: This Firewall
8.3.6 Destination port range: The port range from 8.1.9 and the Member section
8.3.7 Redirect target IP: Same as 8.1.8
8.3.8 Redirect target port: same as 8.3.6
8.3.9 Description: YourPortForward
8.3.10 NAT reflection: Disabled
8.3.11 Filter rule association: None



 

8.4 Port Forwarding IPv6

same as 8.3 just with the IPv6 adjustments

8.4.1 Go to Firewall → NAT → Port Forward, click “*” to create a new rule
8.4.2 Interface: IntAirVPNDE
8.4.3 TCP/IP Version: IPv6
8.4.4 Protocol: TCP/UDP
8.4.5 Destination: This Firewall
8.4.6 Destination port range: The port range from 8.2.9 and the Member section
8.4.7 Redirect target IP: Same as 8.2.8
8.4.8 Redirect target port: same as 8.4.6
8.4.9 Description: YourPortForward
8.4.10 NAT reflection: Disabled
8.4.11 Filter rule association: None


That should be it. Please tell me if you got any issue.

[OpenSourcerer 1468]

On 2/23/2025 at 6:07 PM, OPN-UserGuide said:

I do not have permissions to write into the HowTo Forum, so any mod, please move this guide. Thanks.
Furthermore, this is work in progress. Not sure how long it will take me to finish this guide, might be a few Hours or days... who knows

That forum is not for untested, WIP guides. Finish it, incorporate others' feedback, then it might get moved if verified to work.
Please also make it clear why you wish to write another guide if the existing one still works.

[OPN-UserGuide 2]

19 hours ago, OpenSourcerer said:

That forum is not for untested, WIP guides. Finish it, incorporate others' feedback, then it might get moved if verified to work.
Please also make it clear why you wish to write another guide if the existing one still works.

Sure, will complete it and let others test it.
It's a re-write of some areas to incorporate IPv6 support and correct the WireGuard setup, which was working but not optimal configured.
Also, one or two firewall rules were incorrect as pointed out by one user. The old guide can then be retired, but I let you know when this is the case.

[OpenSourcerer 1468]

Erm, are you the user @Sj0rs, or why are you writing as if the other guide lost its right of existence just because you're writing another? Seems cruel to me to spell it like that, to be honest with you.

[OPN-UserGuide 2]

Hi @OpenSourcerer,

no, I`m not Sj0rs. If you scroll a bit down in his guide you wil lsee I "enhanced" his guide with Pictures, mentioning that this is based on his guide. As you can see his Guide does not have any IPv6 setup and as this was requested I thought it would be good to include it. While testing on my own how to acceive it, I found several "misconfiguratins" in his guide. Therefore I thought it might be good to create a complete new one.

And to be boldly honest, yes the old guide should be marked as "deprecated" once I got the time to finish this guide. (Hope to do this today). Same as, if someone writes another guide adding value to the config can superseed my guide. Sj0rs has not ever replyed in his own guide, so I think he won`t even care what happes with his guide. He didn`t even bother to add pictures when asked nicely in the forum.

If you feel it`s rude from me putting up a guide, let me know I can spend my time with other things then. My Setup is like 99% working so no need for me to post this here, I just wanted to give something back to the community as some of the guidance I`ve found in this forum.

[Staff 10123]

26 minutes ago, OPN-UserGuide said:

If you feel it`s rude from me putting up a guide, let me know I can spend my time with other things then. My Setup is like 99% working so no need for me to post this here, I just wanted to give something back to the community as some of the guidance I`ve found in this forum.

Hello and thank you very much!

Historically, guides written by the community members have always been valuable and of course we appreciate them a lot.

OpenSourcerer is not an AirVPN staff member, he is a community moderator and spends his time for free and for passion to moderate AirVPN community forums. However, he does not influence our decisions to move a guide to "How To" forum (where new threads can be opened only by us) that collects several guides including community written ones. The decision to replace old guides is also our exclusive competence and follows our and community tests.

Please accept our apologies if we have chosen a moderator who discourages you from writing valuable guides for the entire community, but we're sure he is in good faith.

We would like to thank you for your time and dedication now and in the past on the previous guides, and we warmly invite you to overlook this time the moderator's attitude and complete your guide that might replace the old one once it is tested. If we miss your messages when your guide is ready and tested (as OpenSourcerer wrote, a guide must first pass the tests in order to be moved to the guides section) just feel free to contact us directly and give us a reminder. We will then gladly test the guide, check the community feedback and evaluate the replacement.

Kind regards
 

[OPN-UserGuide 2]

35 minutes ago, Staff said:

Please accept our apologies if we have chosen a moderator who discourages you from writing valuable guides for the entire community, but we're sure he is in good faith.

No need to appogies for this or for him. All good, I know it`s important for the community to have moderators and gatekeepers and we`re all human.

Will spend some more time on this guide in some minutes.

[OPN-UserGuide 2]

The guide should be complete now. I will cross-check it, but it would be good if someone could confirm it does not have any major flaws and is actually working.
I can confirm that this is precisely how I got it configured, and it's working perfectly fine for me for some months now, except for the “minor” issue with BitTorrent and port forwarding on IPv6. Furthermore, I'm happy to adjust this once I got a solution for it. But I until think the guide is safe to be used.

@Staff @OpenSourcerer

[OpenSourcerer 1468]

11 hours ago, OPN-UserGuide said:

no, I`m not Sj0rs. If you scroll a bit down in his guide you wil lsee I "enhanced" his guide with Pictures, mentioning that this is based on his guide. As you can see his Guide does not have any IPv6 setup and as this was requested I thought it would be good to include it. While testing on my own how to acceive it, I found several "misconfiguratins" in his guide. Therefore I thought it might be good to create a complete new one.

And to be boldly honest, yes the old guide should be marked as "deprecated" once I got the time to finish this guide. (Hope to do this today). Same as, if someone writes another guide adding value to the config can superseed my guide. Sj0rs has not ever replyed in his own guide, so I think he won`t even care what happes with his guide. He didn`t even bother to add pictures when asked nicely in the forum.

Thank you for providing your motivation, which was all I asked for. A deprecation mark is better than "the old guide can then be retired", which some may interpret as a deletion request.
 

11 hours ago, OPN-UserGuide said:

If you feel it`s rude from me putting up a guide, let me know I can spend my time with other things then. My Setup is like 99% working so no need for me to post this here, I just wanted to give something back to the community as some of the guidance I`ve found in this forum.

Thank you for interpreting my reasonable question for your motivation as offense. I never explicitly wrote that you should stop writing this.
 

10 hours ago, Staff said:

Historically, guides written by the community members have always been valuable and of course we appreciate them a lot.

This. I always make sure to thank the writers and encourage them to finish and enhance their guides; even test them myself if feasible.
 

11 hours ago, Staff said:

We would like to thank you for your time and dedication now and in the past on the previous guides, and we warmly invite you to overlook this time the moderator's attitude and complete your guide that might replace the old one once it is tested

And thank you for apologizing on my account. Who's the rude one here, I wonder…

[OPN-UserGuide 2]

I understand that you wanted to explain yourself, but I would have appreciated it, if it were less offensive...

Anyway, let's get back to the point of the Guide....
 

On 3/27/2025 at 2:47 PM, OPN-UserGuide said:

The guide should be complete now. I will cross-check it, but it would be good if someone could confirm it does not have any major flaws and is actually working.
I can confirm that this is precisely how I got it configured, and it's working perfectly fine for me for some months now, except for the “minor” issue with BitTorrent and port forwarding on IPv6. Furthermore, I'm happy to adjust this once I got a solution for it. But I until think the guide is safe to be used.

@Staff @OpenSourcerer

I would appreciate, when everyone is happy with this guide and there are no further adjustments needed, that before it gets moved, the posts below get removed. I'm happy when all my comments get deleted.