l33tsource

Sometimes random blog posts appear.

© 2026. All rights reserved.

Wireguard Point To Point

26 Oct 2026

OpenVPN gave me some issues connecting from my VPS to home. That's when I decided its finally time to try Wireguard again. And this Blog post is how that went.

                          ┌─────────────────────────┐
                          │         FreeBSD         │
                          │                         │
                          │ Port: 51820             │
                          │ IP: 10.0.1.42/32        │
                          └────▲───────────────▲────┘
                               │               │
                  ┌────────────┘               └────────────┐
                  │                                         │
    ┌─────────────▼───────────┐               ┌─────────────▼───────────┐
    │        OPNsense         │               │        RouterOS         │
    │                         │               │                         │
    │ Port: 51820             ◄───────────────► Port: 52640             │
    │ IP: 10.0.1.41/32        │               │ IP: 10.0.1.41/32        │
    └─────────────────────────┘               └─────────────────────────┘

As you can see in the image I want to connect 3 locations where I run 3 different operating systems to make it interesting.

FreeBSD

I went the route without using wireguard-tools and just use the built in things. This took me some time to figure out but it's not to bad.

Add the interface to /etc/rc.conf

# Wireguard setup
cloned_interfaces="wg0"
ifconfig_wg0="inet 10.0.1.42/32 mtu 1420 up"

And for the Wireguard config itself we need /etc/start_if.wg0 and /etc/wg0.conf.

$ cat /etc/start_if.wg0
wg syncconf wg0 /etc/wg0.conf

$ cat /etc/wg0.conf
[Interface]
# The line below must not be here as this is used only when wireguard-tools is used
# Address = 192.168.145.47/32
# If you want to choose port number open by wireguard, uncomment the line below
ListenPort = 51820
# Run `wg genkey` and `echo ".." | wg pubkey`
PrivateKey = MYPRIVATEKEY=

[Peer]
AllowedIPs = 192.168.XXX.0/24, 10.0.1.41/32
PublicKey = MYKEY=
Endpoint = ip-or-dns:port
PersistentKeepalive = 30

[Peer]
AllowedIPs = 192.168.YYY.0/24, 10.0.1.40/32
PublicKey = MYOTHERKEY=
Endpoint = ip-or-dns:port
PersistentKeepalive = 30

For AllowedIPs i added the subnet I want to reach and the tunnel network itself. PublicKey is relatively self explanatory the key from the other side. Or in other words the key of the wireguard system at the Endpoint.

The thing that took some time to figure out is the correct routes to add. They should be for each subnet that is reachable trough our wireguard.

static_routes="wg17 wg18"
route_wg17="-net 192.168.XXX.0/24 -interface wg0"
route_wg18="-net 192.168.YYY.0/24 -interface wg0"

And that's it for FreeBSD. Restart networking with: sudo service netif restart wg0 && sudo service routing restart, and sync later config changes with sudo wg syncconf wg0 /etc/wg0.conf if needed.

It should look something like this:

$ wg show
interface: wg0
  public key: KEY=
  listening port: 51820

peer: MYKEY=
  endpoint: ip-or-dns:port
  allowed ips: 10.0.1.42/32, 192.168.XXX.0/24
  latest handshake: 1 minute, 6 seconds ago
  transfer: 131.90 MiB received, 6.55 MiB sent
  persistent keepalive: every 30 seconds

peer: MYOTHERKEY=
  endpoint: ip-or-dns:port
  allowed ips: 10.0.1.41/32, 192.168.YYY.0/24
  latest handshake: 1 minute, 19 seconds ago
  transfer: 4.00 KiB received, 9.57 KiB sent
  persistent keepalive: every 30 seconds

Huge shout-out to xsouku04 which talked about this setup on the Forum.

OPNsense

Is relatively strait forward create a instance with Listen port and Tunnel address: 10.0.1.41/32. Then add the Peers:

Public Key: PKEY=
Allowed IPs: 192.168.YYY.0/24 10.0.42/32
Endpoint address: ip-or-dns
Endpoint port: 51820

I did all that via the GUI. See also the official site to site how-to.

RouterOS

RouterOS has good scripting support. Which allows me to share these 2 blocks of config with you, first the Wireguard setup with peers:

/interface wireguard add comment="main wireguard" listen-port=52640 mtu=1420 name=wg1 private-key="PKEY="
/interface wireguard peers add allowed-address=192.168.XXX.0/24,10.0.1.41/32 comment=location-a endpoint-address=ip-or-dns endpoint-port=51820 interface=wg1 name=peer1 public-key="KEY="
/interface wireguard peers add allowed-address=192.168.YYY.0/24,10.0.1.42/32 comment=location-b endpoint-address=ip-or-dns endpoint-port=51820 interface=wg1 name=peer2 public-key="KEY="

Plus these 2 routes:

/ip route add dst-address=10.0.1.0/24 gateway=wg1 comment="outgoing traffic to Wireguard endpoints"
/ip route add dst-address=192.168.YYY.0/24 gateway=wg1 comment="subnet behind Wireguard that should be reachable"

And that's it.

Related Posts