IP address

Internet provider

Amazon Data Services NoVa

Not secure

Your internet provider can monitor what you do online.

Start Guides Wireguard® OPNsense

Install WireGuard on OPNsense

1. SSH

SSH to your OPNsense router

2. Install WireGuard

pkg update && pkg install wireguard && pkg install wireguard-go

3. Generate the config(s) you want

4. Import configuration

In the terminal, execute:

Press Enter to finalize the command.

5. Connect to OVPN

To connect to OVPN, type the following into the terminal:

wg-quick up {{ props.config }}

To disconnect from OVPN, type the following into the terminal:

wg-quick down {{ props.config }}

6. Prevent DNS leaks

Sign into the OPNsense web interface.

guides.wireguard.opnsense.navigate_to SystemSettingsGeneral. Set the DNS servers to:


Make sure Allow DNS server list to be overridden by DHCP/PPP on WAN is not selected. However, Do not use the local DNS service as a nameserver for this system should be selected.

Click on Save and Apply changes.

7. Set up interface

guides.wireguard.opnsense.navigate_to InterfacesAssignments. Click on the orange plus icon.

Click on the interface name.

Make sure Enable interface and Prevent interface removal are selected. Afterwards, click on Save and Apply changes

8. Firewall configuration

guides.wireguard.opnsense.navigate_to FirewallNATOutbound. Click on Hybrid outbound NAT rule generation.

Click on Save. Click on Add in the upper-right corner

There are three modifications that need to be done. Everything else should be left as-is. The changes are:

  • On Interface, select OPT1 from the drop-down menu.
  • On Source Address, select LAN net.
  • On Translation/Target, select Interface address.

Click on Save and Apply changes.

9. Verify that the connection was successful

You should now be connected to OVPN and be able to browse the internet safely. To make sure everything was set up correctly, please check the dashboard to verify that you are connected.


In case you get connected to OVPN in the WireGuard application, but don't have any internet connectivity, please read the troubleshooting article for WireGuard.

If your configuration files don't get imported, read our article about adding your private key manually in the configuration files.