pfSense has shipped WireGuard support directly in its base system since version 2.7, which means you no longer need a third-party package just to get a modern, fast VPN tunnel running on your firewall. This guide covers connecting pfSense to a commercial VPN provider as a client, so every device behind your firewall routes through the VPN automatically, without installing anything on individual devices.
Why do this at the firewall instead of on each device
A pfSense box already sits between your entire network and the internet, so configuring the VPN once at that layer covers every device downstream: laptops, phones, game consoles, smart TVs, and anything else that can’t run a VPN app on its own. It also means the tunnel survives a factory reset or a new device joining the network, since nothing needs to be configured per device.
The tradeoff is the same one that applies to any router-level VPN: switching server locations means editing a firewall configuration rather than tapping a button in an app. Most pfSense users who go this route keep a phone or laptop VPN app for quick location switching and treat the firewall tunnel as the always-on default for everything else on the network.
What you need before starting
A pfSense installation on version 2.7 or later, since that’s when WireGuard moved into the base system rather than requiring a separate package. Admin access to the web interface, and your VPN provider’s WireGuard configuration details: a private key, the provider’s public key, an endpoint address and port, and the allowed IPs and DNS settings your provider assigns. Providers that support manual WireGuard setup typically expose this as a downloadable configuration file or a details screen in their account dashboard.
Step 1: confirm WireGuard is available
On pfSense 2.7 and later, WireGuard ships in the base install and appears under VPN > WireGuard in the web interface without any extra package installation. If you’re on an older version, install the WireGuard package first through System > Package Manager > Available Packages, then reboot before continuing.
Step 2: create the WireGuard tunnel
Go to VPN > WireGuard > Tunnels and add a new tunnel. Give it a clear description, generate or paste in a private key, and assign it a tunnel address in a private range that doesn’t overlap with your existing LAN, something like 10.10.10.1/24 works for most home setups. Save the tunnel once created.
Step 3: add the peer (your VPN provider’s server)
Still under the same tunnel, add a peer entry with your provider’s details:
- Public key: your provider’s server public key
- Endpoint: the server’s hostname or IP address
- Endpoint port: usually 51820, though some providers assign a different one
- Allowed IPs:
0.0.0.0/0to route all traffic through the tunnel - Keep alive: 25 seconds, which maintains the tunnel through NAT on both ends
Save and apply the changes.
Step 4: assign the tunnel as an interface
Go to Interfaces > Assignments and assign the new WireGuard tunnel as an interface, then enable it under Interfaces and give it a recognizable name like WG_VPN. This step is easy to skip and is the reason a correctly configured tunnel sometimes still doesn’t pass traffic; pfSense needs the tunnel formally assigned as an interface before firewall rules can reference it properly.
Step 5: set firewall rules on the new interface
Under Firewall > Rules, select your new WireGuard interface tab and add a rule allowing traffic from your LAN’s source network to any destination. Without this rule, the tunnel can be technically “up” while nothing actually routes through it.
| Setting | Typical value |
|---|---|
| Interface | WG_VPN |
| Source | LAN net |
| Destination | Any |
| Protocol | Any |
Step 6: configure outbound NAT for the tunnel
Under Firewall > NAT > Outbound, switch to hybrid or manual mode and add a rule mapping your LAN network to the WireGuard interface. This is the step that actually makes traffic appear to originate from your VPN provider’s IP address rather than your own; without it, packets can pass through the tunnel interface without being properly translated, and connections will fail or silently fall back to your regular WAN.
Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.
Step 7: route LAN traffic through the VPN gateway
Go to System > Routing > Gateways and confirm a gateway exists for the WireGuard interface, then either set it as your default gateway (routes everything through the VPN) or use a policy-based routing rule under Firewall > Rules on your LAN interface to send only specific traffic through it. Policy routing is the better choice if you want some devices, a smart home hub or a games console with strict NAT requirements, for example, to bypass the VPN while everything else uses it.
Step 8: confirm the tunnel is actually working
Don’t skip this part. From a device behind pfSense, run an IP leak test and confirm the address shown belongs to your VPN provider rather than your ISP. Check Status > WireGuard in the pfSense web interface to confirm the peer shows a recent handshake rather than sitting idle, since a tunnel that shows as configured but has no handshake almost always points to a firewall or NAT problem from Steps 5 or 6, not the WireGuard keys themselves.
Troubleshooting the most common failures
| Symptom | Likely cause | Fix |
|---|---|---|
| Tunnel shows up, no handshake | Endpoint port blocked, or wrong public key | Recheck peer settings, confirm the port isn’t blocked upstream |
| Handshake succeeds, no internet | Outbound NAT rule missing | Revisit Step 6, confirm the NAT mapping to the WireGuard interface |
| Some devices route through VPN, others don’t | Policy routing rule scoped too narrowly | Confirm the LAN rule’s source network covers the devices in question |
| Speeds noticeably below your normal connection | pfSense hardware can’t keep up with encryption | Check your appliance’s WireGuard throughput ceiling; older low-power boxes struggle at gigabit speeds |
| Connection drops periodically | Keep-alive not set, or provider rotating server IPs | Confirm keep-alive is set to 25 seconds on the peer |
Picking a provider that supports this well
Not every VPN provider makes a manual WireGuard configuration easy to generate, since some steer users toward their own apps instead. NordVPN and Proton VPN both offer manual WireGuard configuration generation through their account dashboards, which is what this guide assumes. Mullvad’s setup is similarly straightforward and doesn’t require an account beyond a generated number. Providers without a manual export option usually require workarounds involving their own command-line tools, which is a more involved process than most pfSense users want for a router-level setup.
Setting up a WireGuard client on pfSense takes about 30 minutes for someone already comfortable with the firewall's interface, most of it spent on the NAT and firewall rule steps rather than the tunnel itself. It's the right approach for a household or small office that wants one VPN connection covering every device permanently, rather than for someone who needs to switch server locations several times a day. Confirm the outbound NAT rule carefully, and always test with an IP leak check before trusting the setup for anything sensitive.
Keep reading: How to Set Up a VPN on an OpenWrt Router and WireGuard vs OpenVPN: Which Protocol Should You Use in 2026?.