44Net Connect/Quick Start/PFsense: Difference between revisions
Created page |
Wrote Enable WireGuard section |
||
| (4 intermediate revisions by the same user not shown) | |||
| Line 9: | Line 9: | ||
Unlike other Quick Start guides, we aren't starting with a configuration file from 44Net Connect. Instead, we will be creating one during the course of this tutorial. | Unlike other Quick Start guides, we aren't starting with a configuration file from 44Net Connect. Instead, we will be creating one during the course of this tutorial. | ||
== | == Install the WireGuard Package == | ||
WireGuard is not installed by default on PFsense, so we need to install it. Go to <code>System > Package Manager > Available Packages</code> and install WireGuard. | |||
== | == Generate keypair and create tunnel == | ||
After installing WireGuard, go to <code>VPN > WireGuard > Tunnels</code> and click the <code>Add Tunnel</code> button. | |||
Click the <code>Generate</code> button to generate a new keypair. Then, open your [https://connect.44net.cloud/tunnels tunnels page in 44Net Connect], request a new tunnel, and select your preferred server. | |||
In the <code>Public Key</code> field, paste the public key generated in PFsense, then click <code>Create Tunnel</code> to save. Retain the wg-quick WireGuard config for use in later steps. | |||
== Copy tunnel | == Fill in interface == | ||
Copy the interface addresses from your config file into the Interface Addresses section in your PFsense WireGuard tunnel configuration. Adding the IPv6 address is optional but recommended. If you're doing so, click the <code>Add Address</code> button to add another IP address field. For all entries, use the drop-down menu to configure the subnet. For the IPv4 address it should be /32, and for the IPv6 address it should be /64. There are some places on 44Net Connect that are labeled in a confusing way, and could be interpreted as your tunnel being allocated a /24 for IPv4, but a tunnel will always receive a /32 for IPv4. | |||
Click <code>Save Tunnel</code>. PFsense won't let you add peers until you save the tunnel. In the next step, we'll edit the tunnel to add a peer. | |||
== Add Peer == | |||
Click the <code>Add Peer</code> button. Uncheck the <code>Dynamic Endpoint</code> box, as this will allow us to fill in a static IP and port for the endpoint. Fill in the endpoint IP and port from the <code>[Peer]</code> section of the WireGuard config file. Also copy in MTU, Keep Alive interval, the peer's public key, and if applicable, the pre-shared key. | |||
Fill in the Allowed IPs section at the bottom using the values from the config file, which by default is <code>0.0.0.0/0</code> and <code>::/0</code>. This configuration allows all addresses, and will let you pass all traffic through the tunnel. If you want only traffic to and from your 44Net IP to go through the tunnel, change your AllowedIPs to <code>44.0.0.0/9</code> and <code>44.128.0.0/10</code>. | |||
== Enable WireGuard == | |||
Go to <code>VPN > WireGuard > Settings</code> and check the <code>Enable WireGuard</code> box, then save your changes. If prompted with a banner at the top to save your WireGuard settings before applying, do so. Check the status of your tunnel by going to <code>Status > WireGuard</code>, clicking the arrow next to your tunnel to expand its section, and verifying that it's performed a handshake with the endpoint. | |||
Latest revision as of 19:21, 9 July 2026
What you need
- A 44Net Portal account
- A verified amateur radio callsign
- A machine running PFsense
- Some sort of Internet access
If you haven't set up your Portal account or verified your callsign yet, see 44Net: Get Started for instructions. If you haven't obtained a WireGuard tunnel configuration file from 44Net Connect, get one using the the 44Net Connect quick start guide
Unlike other Quick Start guides, we aren't starting with a configuration file from 44Net Connect. Instead, we will be creating one during the course of this tutorial.
Install the WireGuard Package
WireGuard is not installed by default on PFsense, so we need to install it. Go to System > Package Manager > Available Packages and install WireGuard.
Generate keypair and create tunnel
After installing WireGuard, go to VPN > WireGuard > Tunnels and click the Add Tunnel button.
Click the Generate button to generate a new keypair. Then, open your tunnels page in 44Net Connect, request a new tunnel, and select your preferred server.
In the Public Key field, paste the public key generated in PFsense, then click Create Tunnel to save. Retain the wg-quick WireGuard config for use in later steps.
Fill in interface
Copy the interface addresses from your config file into the Interface Addresses section in your PFsense WireGuard tunnel configuration. Adding the IPv6 address is optional but recommended. If you're doing so, click the Add Address button to add another IP address field. For all entries, use the drop-down menu to configure the subnet. For the IPv4 address it should be /32, and for the IPv6 address it should be /64. There are some places on 44Net Connect that are labeled in a confusing way, and could be interpreted as your tunnel being allocated a /24 for IPv4, but a tunnel will always receive a /32 for IPv4.
Click Save Tunnel. PFsense won't let you add peers until you save the tunnel. In the next step, we'll edit the tunnel to add a peer.
Add Peer
Click the Add Peer button. Uncheck the Dynamic Endpoint box, as this will allow us to fill in a static IP and port for the endpoint. Fill in the endpoint IP and port from the [Peer] section of the WireGuard config file. Also copy in MTU, Keep Alive interval, the peer's public key, and if applicable, the pre-shared key.
Fill in the Allowed IPs section at the bottom using the values from the config file, which by default is 0.0.0.0/0 and ::/0. This configuration allows all addresses, and will let you pass all traffic through the tunnel. If you want only traffic to and from your 44Net IP to go through the tunnel, change your AllowedIPs to 44.0.0.0/9 and 44.128.0.0/10.
Enable WireGuard
Go to VPN > WireGuard > Settings and check the Enable WireGuard box, then save your changes. If prompted with a banner at the top to save your WireGuard settings before applying, do so. Check the status of your tunnel by going to Status > WireGuard, clicking the arrow next to your tunnel to expand its section, and verifying that it's performed a handshake with the endpoint.