44Net Connect/Quick Start/PFsense: Difference between revisions

Latest revision as of 16:33, 14 July 2026

What you need

A 44Net Portal account
A verified amateur radio callsign
A machine running PFsense
Some sort of Internet access

If you haven't set up your Portal account or verified your callsign yet, see 44Net: Get Started for instructions. If you haven't obtained a WireGuard tunnel configuration file from 44Net Connect, get one using the the 44Net Connect quick start guide

Unlike other Quick Start guides, we aren't starting with a configuration file from 44Net Connect. Instead, we will be creating one during the course of this tutorial.

Install the WireGuard Package

WireGuard is not installed by default on PFsense, so we need to install it. Go to System > Package Manager > Available Packages and install WireGuard.

Generate keypair and create tunnel

After installing WireGuard, go to VPN > WireGuard > Tunnels and click the Add Tunnel button. Click the Generate button to generate a new keypair.

Then, open your tunnels page in 44Net Connect, request a new tunnel, and select your preferred server. In the Public Key field, paste the public key generated in PFsense, then click Create Tunnel to save. Retain the wg-quick WireGuard config for use in later steps.

Fill in interface

Copy the interface addresses from your config file into the Interface Addresses section in your PFsense WireGuard tunnel configuration. Adding the IPv6 address is optional but recommended. If you're doing so, click the Add Address button to add another IP address field. For all entries, use the drop-down menu to configure the subnet. For the IPv4 address it should be /32, and for the IPv6 address it should be /64. There are some places on 44Net Connect that are labeled in a confusing way, and could be interpreted as your tunnel being allocated a /24 for IPv4, but a tunnel will always receive a /32 for IPv4.

PFsense won't let you add peers until you save the tunnel. Click Save Tunnel to save, and we'll add peers in the next step.

Add Peer

Click the Add Peer button. Uncheck the Dynamic Endpoint box, as this will allow us to fill in a static IP and port for the endpoint. Fill in the endpoint IP and port from the [Peer] section of the WireGuard config file. Also copy in MTU, Keep Alive interval, the peer's public key, and if applicable, the pre-shared key.

Fill in the Allowed IPs section at the bottom using the values from the config file, which by default is 0.0.0.0/0 and ::/0. This configuration allows all addresses, and will let you pass all traffic through the tunnel. If you want only traffic to and from your 44Net IP to go through the tunnel, change your AllowedIPs to 44.0.0.0/9 and 44.128.0.0/10.

Enable WireGuard

Go to VPN > WireGuard > Settings and check the Enable WireGuard box, then save your changes. If prompted with a banner at the top to save your WireGuard settings before applying, do so. Check the status of your tunnel by going to Status > WireGuard, clicking the arrow next to your tunnel to expand its section, and verifying that it's performed a handshake with the endpoint.

Troubleshooting

Tunnel is up but peer is not

If your tunnel is up (indicated by the green up arrow) but your peer connection is not, there may be something wrong with your peer configuration. Double check it against the config file. Ensure your allowed IPs are set correctly, and that the subnet size is correctly selected in the drop-down menu.

Tunnel will not connect

Ensure that the dynamic endpoint checkbox is unchecked. Verify that the tunnel's endpoint IP, endpoint port, keep alive time, and public key are correct. If you are using a pre-shared key, make sure that it matches the one set in 44Net connect.

@@ Line 34: / Line 34: @@
 Fill in the Allowed IPs section at the bottom using the values from the config file, which by default is <code>0.0.0.0/0</code> and <code>::/0</code>. This configuration allows all addresses, and will let you pass all traffic through the tunnel. If you want only traffic to and from your 44Net IP to go through the tunnel, change your AllowedIPs to <code>44.0.0.0/9</code> and <code>44.128.0.0/10</code>.
+[[File:pfsense_peer_allowed_ips.png|A side-by-side view of the PFsense WireGuard peer configuration page and a wg-quick configuration file. Red arrows show where to copy allowed IPs from the configuration file to the PFsense configuration page.]]
 == Enable WireGuard ==
 Go to <code>VPN > WireGuard > Settings</code> and check the <code>Enable WireGuard</code> box, then save your changes. If prompted with a banner at the top to save your WireGuard settings before applying, do so. Check the status of your tunnel by going to <code>Status > WireGuard</code>, clicking the arrow next to your tunnel to expand its section, and verifying that it's performed a handshake with the endpoint.
+[[File:pfsense_wireguard_status.png|A screenshot of the PFSense WireGuard status page. There is a green handshake icon, and the latest handshake was 1 minute 54 seconds ago.]]
+== Troubleshooting ==
+=== Tunnel is up but peer is not ===
+If your tunnel is up (indicated by the green up arrow) but your peer connection is not, there may be something wrong with your peer configuration. Double check it against the config file. Ensure your allowed IPs are set correctly, and that the subnet size is correctly selected in the drop-down menu.
+=== Tunnel will not connect ===
+Ensure that the dynamic endpoint checkbox is unchecked. Verify that the tunnel's endpoint IP, endpoint port, keep alive time, and public key are correct. If you are using a pre-shared key, make sure that it matches the one set in 44Net connect.