44Net Connect/Quick Start/PFsense - Revision history

KN6DWI: Added troubleshooting section

2026-07-14T16:33:16Z

Added troubleshooting section

← Older revision		Revision as of 16:33, 14 July 2026
Line 41:		Line 41:

	[[File:pfsense_wireguard_status.png\|A screenshot of the PFSense WireGuard status page. There is a green handshake icon, and the latest handshake was 1 minute 54 seconds ago.]]		[[File:pfsense_wireguard_status.png\|A screenshot of the PFSense WireGuard status page. There is a green handshake icon, and the latest handshake was 1 minute 54 seconds ago.]]

			== Troubleshooting ==
			=== Tunnel is up but peer is not ===
			If your tunnel is up (indicated by the green up arrow) but your peer connection is not, there may be something wrong with your peer configuration. Double check it against the config file. Ensure your allowed IPs are set correctly, and that the subnet size is correctly selected in the drop-down menu.

			=== Tunnel will not connect ===
			Ensure that the dynamic endpoint checkbox is unchecked. Verify that the tunnel's endpoint IP, endpoint port, keep alive time, and public key are correct. If you are using a pre-shared key, make sure that it matches the one set in 44Net connect.

KN6DWI: /* Enable WireGuard */

2026-07-14T04:53:04Z

Enable WireGuard

← Older revision		Revision as of 04:53, 14 July 2026
Line 39:		Line 39:
	== Enable WireGuard ==		== Enable WireGuard ==
	Go to <code>VPN > WireGuard > Settings</code> and check the <code>Enable WireGuard</code> box, then save your changes. If prompted with a banner at the top to save your WireGuard settings before applying, do so. Check the status of your tunnel by going to <code>Status > WireGuard</code>, clicking the arrow next to your tunnel to expand its section, and verifying that it's performed a handshake with the endpoint.		Go to <code>VPN > WireGuard > Settings</code> and check the <code>Enable WireGuard</code> box, then save your changes. If prompted with a banner at the top to save your WireGuard settings before applying, do so. Check the status of your tunnel by going to <code>Status > WireGuard</code>, clicking the arrow next to your tunnel to expand its section, and verifying that it's performed a handshake with the endpoint.

			[[File:pfsense_wireguard_status.png\|A screenshot of the PFSense WireGuard status page. There is a green handshake icon, and the latest handshake was 1 minute 54 seconds ago.]]

KN6DWI: Added picture for filling in allowed IPs

2026-07-14T00:07:24Z

Added picture for filling in allowed IPs

← Older revision		Revision as of 00:07, 14 July 2026
Line 34:		Line 34:

	Fill in the Allowed IPs section at the bottom using the values from the config file, which by default is <code>0.0.0.0/0</code> and <code>::/0</code>. This configuration allows all addresses, and will let you pass all traffic through the tunnel. If you want only traffic to and from your 44Net IP to go through the tunnel, change your AllowedIPs to <code>44.0.0.0/9</code> and <code>44.128.0.0/10</code>.		Fill in the Allowed IPs section at the bottom using the values from the config file, which by default is <code>0.0.0.0/0</code> and <code>::/0</code>. This configuration allows all addresses, and will let you pass all traffic through the tunnel. If you want only traffic to and from your 44Net IP to go through the tunnel, change your AllowedIPs to <code>44.0.0.0/9</code> and <code>44.128.0.0/10</code>.

			[[File:pfsense_peer_allowed_ips.png\|A side-by-side view of the PFsense WireGuard peer configuration page and a wg-quick configuration file. Red arrows show where to copy allowed IPs from the configuration file to the PFsense configuration page.]]

	== Enable WireGuard ==		== Enable WireGuard ==
	Go to <code>VPN > WireGuard > Settings</code> and check the <code>Enable WireGuard</code> box, then save your changes. If prompted with a banner at the top to save your WireGuard settings before applying, do so. Check the status of your tunnel by going to <code>Status > WireGuard</code>, clicking the arrow next to your tunnel to expand its section, and verifying that it's performed a handshake with the endpoint.		Go to <code>VPN > WireGuard > Settings</code> and check the <code>Enable WireGuard</code> box, then save your changes. If prompted with a banner at the top to save your WireGuard settings before applying, do so. Check the status of your tunnel by going to <code>Status > WireGuard</code>, clicking the arrow next to your tunnel to expand its section, and verifying that it's performed a handshake with the endpoint.

KN6DWI: Added image for peer configuration

2026-07-13T18:51:56Z

Added image for peer configuration

← Older revision		Revision as of 18:51, 13 July 2026
Line 30:		Line 30:
	== Add Peer ==		== Add Peer ==
	Click the <code>Add Peer</code> button. Uncheck the <code>Dynamic Endpoint</code> box, as this will allow us to fill in a static IP and port for the endpoint. Fill in the endpoint IP and port from the <code>[Peer]</code> section of the WireGuard config file. Also copy in MTU, Keep Alive interval, the peer's public key, and if applicable, the pre-shared key.		Click the <code>Add Peer</code> button. Uncheck the <code>Dynamic Endpoint</code> box, as this will allow us to fill in a static IP and port for the endpoint. Fill in the endpoint IP and port from the <code>[Peer]</code> section of the WireGuard config file. Also copy in MTU, Keep Alive interval, the peer's public key, and if applicable, the pre-shared key.

			[[File:pfsense_peer_configuration.png\|A side-by-side view of the PFsense WireGuard peer configuration page and a wg-quick configuration file. Red numbered dots indicate where to copy the information from the config file to the configuration page.]]

	Fill in the Allowed IPs section at the bottom using the values from the config file, which by default is <code>0.0.0.0/0</code> and <code>::/0</code>. This configuration allows all addresses, and will let you pass all traffic through the tunnel. If you want only traffic to and from your 44Net IP to go through the tunnel, change your AllowedIPs to <code>44.0.0.0/9</code> and <code>44.128.0.0/10</code>.		Fill in the Allowed IPs section at the bottom using the values from the config file, which by default is <code>0.0.0.0/0</code> and <code>::/0</code>. This configuration allows all addresses, and will let you pass all traffic through the tunnel. If you want only traffic to and from your 44Net IP to go through the tunnel, change your AllowedIPs to <code>44.0.0.0/9</code> and <code>44.128.0.0/10</code>.

KN6DWI: Added picture for filling in the tunnel IPs and made a minor grammatical edit

2026-07-13T18:10:31Z

Added picture for filling in the tunnel IPs and made a minor grammatical edit

← Older revision		Revision as of 18:10, 13 July 2026
Line 24:		Line 24:
	Copy the interface addresses from your config file into the Interface Addresses section in your PFsense WireGuard tunnel configuration. Adding the IPv6 address is optional but recommended. If you're doing so, click the <code>Add Address</code> button to add another IP address field. For all entries, use the drop-down menu to configure the subnet. For the IPv4 address it should be /32, and for the IPv6 address it should be /64. There are some places on 44Net Connect that are labeled in a confusing way, and could be interpreted as your tunnel being allocated a /24 for IPv4, but a tunnel will always receive a /32 for IPv4.		Copy the interface addresses from your config file into the Interface Addresses section in your PFsense WireGuard tunnel configuration. Adding the IPv6 address is optional but recommended. If you're doing so, click the <code>Add Address</code> button to add another IP address field. For all entries, use the drop-down menu to configure the subnet. For the IPv4 address it should be /32, and for the IPv6 address it should be /64. There are some places on 44Net Connect that are labeled in a confusing way, and could be interpreted as your tunnel being allocated a /24 for IPv4, but a tunnel will always receive a /32 for IPv4.

	~~Click <code>Save Tunnel</code>~~. PFsense won't let you add peers until you save the tunnel. ~~In the next step~~, we'll ~~edit~~ the ~~tunnel to add a peer~~.		[[File:pfsense_interface.png\|A side-by-side view of the PFsense WireGuard interface configuration page, and a wg-quick config file opened in the Kate text editor. A red arrow indicates where one should copy the IP addresses from the config file into the configuration page.]]

			PFsense won't let you add peers until you save the tunnel. Click <code>Save Tunnel</code> to save, and we'll add peers in the next step.

	== Add Peer ==		== Add Peer ==

KN6DWI: Added picture of keypair generation button

2026-07-13T17:53:50Z

Added picture of keypair generation button

← Older revision		Revision as of 17:53, 13 July 2026
Line 14:		Line 14:
	== Generate keypair and create tunnel ==		== Generate keypair and create tunnel ==
	After installing WireGuard, go to <code>VPN > WireGuard > Tunnels</code> and click the <code>Add Tunnel</code> button.		After installing WireGuard, go to <code>VPN > WireGuard > Tunnels</code> and click the <code>Add Tunnel</code> button.
	Click the <code>Generate</code> button to generate a new keypair. Then, open your [https://connect.44net.cloud/tunnels tunnels page in 44Net Connect], request a new tunnel, and select your preferred server.		Click the <code>Generate</code> button to generate a new keypair.

			[[File:pfsense_generate_keypair.png\|A screenshot of the PFsense WireGuard tunnel configuration page. The button to generate a new WireGuard keypair is highlighted with a red box.]]

			Then, open your [https://connect.44net.cloud/tunnels tunnels page in 44Net Connect], request a new tunnel, and select your preferred server.
	In the <code>Public Key</code> field, paste the public key generated in PFsense, then click <code>Create Tunnel</code> to save. Retain the wg-quick WireGuard config for use in later steps.		In the <code>Public Key</code> field, paste the public key generated in PFsense, then click <code>Create Tunnel</code> to save. Retain the wg-quick WireGuard config for use in later steps.

KN6DWI: Wrote Enable WireGuard section

2026-07-09T19:21:32Z

Wrote Enable WireGuard section

← Older revision		Revision as of 19:21, 9 July 2026
Line 26:		Line 26:

	Fill in the Allowed IPs section at the bottom using the values from the config file, which by default is <code>0.0.0.0/0</code> and <code>::/0</code>. This configuration allows all addresses, and will let you pass all traffic through the tunnel. If you want only traffic to and from your 44Net IP to go through the tunnel, change your AllowedIPs to <code>44.0.0.0/9</code> and <code>44.128.0.0/10</code>.		Fill in the Allowed IPs section at the bottom using the values from the config file, which by default is <code>0.0.0.0/0</code> and <code>::/0</code>. This configuration allows all addresses, and will let you pass all traffic through the tunnel. If you want only traffic to and from your 44Net IP to go through the tunnel, change your AllowedIPs to <code>44.0.0.0/9</code> and <code>44.128.0.0/10</code>.

			== Enable WireGuard ==
			Go to <code>VPN > WireGuard > Settings</code> and check the <code>Enable WireGuard</code> box, then save your changes. If prompted with a banner at the top to save your WireGuard settings before applying, do so. Check the status of your tunnel by going to <code>Status > WireGuard</code>, clicking the arrow next to your tunnel to expand its section, and verifying that it's performed a handshake with the endpoint.

KN6DWI: Wrote section on adding peer

2026-07-09T19:18:44Z

Wrote section on adding peer

← Older revision		Revision as of 19:18, 9 July 2026
Line 23:		Line 23:

	== Add Peer ==		== Add Peer ==
			Click the <code>Add Peer</code> button. Uncheck the <code>Dynamic Endpoint</code> box, as this will allow us to fill in a static IP and port for the endpoint. Fill in the endpoint IP and port from the <code>[Peer]</code> section of the WireGuard config file. Also copy in MTU, Keep Alive interval, the peer's public key, and if applicable, the pre-shared key.

			Fill in the Allowed IPs section at the bottom using the values from the config file, which by default is <code>0.0.0.0/0</code> and <code>::/0</code>. This configuration allows all addresses, and will let you pass all traffic through the tunnel. If you want only traffic to and from your 44Net IP to go through the tunnel, change your AllowedIPs to <code>44.0.0.0/9</code> and <code>44.128.0.0/10</code>.

KN6DWI: Wrote section on filling in interface

2026-07-09T18:51:48Z

Wrote section on filling in interface

← Older revision		Revision as of 18:51, 9 July 2026
Line 17:		Line 17:
	In the <code>Public Key</code> field, paste the public key generated in PFsense, then click <code>Create Tunnel</code> to save. Retain the wg-quick WireGuard config for use in later steps.		In the <code>Public Key</code> field, paste the public key generated in PFsense, then click <code>Create Tunnel</code> to save. Retain the wg-quick WireGuard config for use in later steps.

	== ~~Create a~~ tunnel in 44Net Connect ==		== Fill in interface ==
			Copy the interface addresses from your config file into the Interface Addresses section in your PFsense WireGuard tunnel configuration. Adding the IPv6 address is optional but recommended. If you're doing so, click the <code>Add Address</code> button to add another IP address field. For all entries, use the drop-down menu to configure the subnet. For the IPv4 address it should be /32, and for the IPv6 address it should be /64. There are some places on 44Net Connect that are labeled in a confusing way, and could be interpreted as your tunnel being allocated a /24 for IPv4, but a tunnel will always receive a /32 for IPv4.

	== ~~Copy tunnel details into PFsense~~ ==		Click <code>Save Tunnel</code>. PFsense won't let you add peers until you save the tunnel. In the next step, we'll edit the tunnel to add a peer.

			== Add Peer ==

KN6DWI: Wrote section on generating keypair and creating tunnel

2026-07-09T18:01:23Z

Wrote section on generating keypair and creating tunnel

← Older revision		Revision as of 18:01, 9 July 2026
Line 12:		Line 12:
	WireGuard is not installed by default on PFsense, so we need to install it. Go to <code>System > Package Manager > Available Packages</code> and install WireGuard.		WireGuard is not installed by default on PFsense, so we need to install it. Go to <code>System > Package Manager > Available Packages</code> and install WireGuard.

	== Generate a keypair in PFsense ==		== Generate keypair and create tunnel ==
			After installing WireGuard, go to <code>VPN > WireGuard > Tunnels</code> and click the <code>Add Tunnel</code> button.
			Click the <code>Generate</code> button to generate a new keypair. Then, open your [https://connect.44net.cloud/tunnels tunnels page in 44Net Connect], request a new tunnel, and select your preferred server.
			In the <code>Public Key</code> field, paste the public key generated in PFsense, then click <code>Create Tunnel</code> to save. Retain the wg-quick WireGuard config for use in later steps.

	== Create a tunnel in 44Net Connect ==		== Create a tunnel in 44Net Connect ==

	== Copy tunnel details into PFsense ==		== Copy tunnel details into PFsense ==