44Net Connect/Quick Start/OPNsense: Difference between revisions
Created page and what you need section |
Added Activate Instance section and Troubleshooting section |
||
| (7 intermediate revisions by the same user not shown) | |||
| Line 9: | Line 9: | ||
Unlike the other Quick Start guides, we aren't starting with a configuration file from 44Net Connect. Instead, we will be creating one during the course of this tutorial. | Unlike the other Quick Start guides, we aren't starting with a configuration file from 44Net Connect. Instead, we will be creating one during the course of this tutorial. | ||
== | == Generate a keypair in OPNsense == | ||
Navigate to <code>VPN > WireGuard > Instances</code> in your OPNsense web GUI and create a new instance. Click the gear button to generate a public key/private key keypair. | Navigate to <code>VPN > WireGuard > Instances</code> in your OPNsense web GUI and create a new instance. Click the gear button to generate a public key/private key keypair. | ||
[[File:opnsense_keypair_generation.png|500px|A screenshot of the OPNsense edit instance dialogue, with the gear button next to the public key field circled in red.]] | |||
== Create a tunnel in 44Net Connect == | |||
Open your [https://connect.44net.cloud/tunnels tunnels page in 44Net Connect] and click <code>Request a Tunnel</code>. Select your preferred server. In the <code>Public Key</code> field, paste the public key generated in OPNsense, then <code>Create Tunnel</code>. Save the wg-quick WireGuard config for use in later steps. | |||
[[File:request_tunnel_44net_connect.png|A screenshot of the 44Net Connect tunnel page header with the Request Tunnel button highlighted in a red box]] | |||
== Copy the tunnel details into OPNsense == | |||
=== Fill out instance === | |||
Go back to your OPNsense Web UI. Give your instance a name, and fill out the <code>Tunnel address</code> field with the addresses from the <code>[Interface]</code> section of the config. Check the <code>Disable routes</code> checkbox, then save your instance. | |||
[[File:opnsense_populate_instance.png| A screenshot with a side by side view of a WireGuard config file and an OPNsense WireGuard instance configuration page. A red arrow indicates how to copy the tunnel addresses from the config file to the OPNsense configuration page. A red rectangle indicates that the user should check the "Disable Routes" box.]] | |||
=== Fill out peer === | |||
Go to <code>VPN > WireGuard > Peers</code> in your OPNsense Web UI, and click the orange <code>+</code> button in the bottom right to create a new peer. Give it a name, and paste the <code>PublicKey</code> value from the <code>[Peer]</code> section of your config file into the peer's <code>Public key</code> field. If you configured a pre-shared key when creating your tunnel, enter it in | |||
the <code>Pre-shared key</code> field. Also copy in <code>Allowed IPs</code>, <code>Endpoint address</code>, <code>Endpoint port</code>, and <code>Keepalive interval</code> from the <code>[Peer]</code> section of your config file. | |||
[[File:opnsense_populate_peer_endpoint.png|A side by side screenshot of the OPNsense peer configuration dialogue next to a WireGuard configuration file. Two red arrows indicate where to copy the endpoint IP and port from the config file to the OPNsense configuration dialogue.]] | |||
[[File:opnsense_populate_peer_keepalive_addresses.png|A side by side screenshot of the OPNsense peer configuration dialogue next to a WireGuard configuration file. Red arrows indicate where to copy the public key, keepalive interval, and allowed IPs from the config file to the OPNsense configuration dialogue.]] | |||
In the <code>Instances</code> field, use the drop-down menu to select the instance you created earlier in this tutorial. | |||
Finally, save your peer, go back to the configuration for your instance, and add the peer you just created. | |||
=== Activate Instance === | |||
On the instances page, ensure your instance is enabled, check the box to enable WireGuard, then apply your changes. | |||
[[File:opnsense_enable_instance.png|A screenshot of the OPNsense WireGuard instances page, with the "Enable WireGuard" checkbox and enable instance checkbox highlighted with red rectangles.]] | |||
Go to <code>WireGuard > Status</code> and ensure that both your instance and your peer display green checkmarks. If they do, you're good to go! | |||
[[File:opnsense_wireguard_status.png|A screenshot of the OPNsense WireGuard status page. Both the interface and the peer show green checkmarks in the status column.]] | |||
== Troubleshooting == | |||
=== Peer status displays a question mark === | |||
Minor misconfiguration of the peer can cause a question mark in the status page and a nonfunctional tunnel. Double check that the peer's configuration matches the WireGuard config file, and make sure your peer is configured with a /32. There are some places on 44Net Connect that are labeled in a confusing way and could be interpreted as your tunnel being allocated a /24, but a tunnel will always receive a /32. | |||
Latest revision as of 17:37, 8 July 2026
What you need
- A 44Net Portal account
- A verified amateur radio callsign
- A machine running OPNsense
- Some sort of Internet access
If you haven't set up your Portal account or verified your callsign yet, see 44Net: Get Started for instructions. If you haven't obtained a WireGuard tunnel configuration file from 44Net Connect, get one using the the 44Net Connect quick start guide
Unlike the other Quick Start guides, we aren't starting with a configuration file from 44Net Connect. Instead, we will be creating one during the course of this tutorial.
Generate a keypair in OPNsense
Navigate to VPN > WireGuard > Instances in your OPNsense web GUI and create a new instance. Click the gear button to generate a public key/private key keypair.
Create a tunnel in 44Net Connect
Open your tunnels page in 44Net Connect and click Request a Tunnel. Select your preferred server. In the Public Key field, paste the public key generated in OPNsense, then Create Tunnel. Save the wg-quick WireGuard config for use in later steps.
Copy the tunnel details into OPNsense
Fill out instance
Go back to your OPNsense Web UI. Give your instance a name, and fill out the Tunnel address field with the addresses from the [Interface] section of the config. Check the Disable routes checkbox, then save your instance.
Fill out peer
Go to VPN > WireGuard > Peers in your OPNsense Web UI, and click the orange + button in the bottom right to create a new peer. Give it a name, and paste the PublicKey value from the [Peer] section of your config file into the peer's Public key field. If you configured a pre-shared key when creating your tunnel, enter it in
the Pre-shared key field. Also copy in Allowed IPs, Endpoint address, Endpoint port, and Keepalive interval from the [Peer] section of your config file.
In the Instances field, use the drop-down menu to select the instance you created earlier in this tutorial.
Finally, save your peer, go back to the configuration for your instance, and add the peer you just created.
Activate Instance
On the instances page, ensure your instance is enabled, check the box to enable WireGuard, then apply your changes.
Go to WireGuard > Status and ensure that both your instance and your peer display green checkmarks. If they do, you're good to go!
Troubleshooting
Peer status displays a question mark
Minor misconfiguration of the peer can cause a question mark in the status page and a nonfunctional tunnel. Double check that the peer's configuration matches the WireGuard config file, and make sure your peer is configured with a /32. There are some places on 44Net Connect that are labeled in a confusing way and could be interpreted as your tunnel being allocated a /24, but a tunnel will always receive a /32.