44Net Connect/Quick Start/PFsense

What you need

A 44Net Portal account
A verified amateur radio callsign
A machine running PFsense
Some sort of Internet access

If you haven't set up your Portal account or verified your callsign yet, see 44Net: Get Started for instructions. If you haven't obtained a WireGuard tunnel configuration file from 44Net Connect, get one using the the 44Net Connect quick start guide

Unlike other Quick Start guides, we aren't starting with a configuration file from 44Net Connect. Instead, we will be creating one during the course of this tutorial.

Install the WireGuard Package

WireGuard is not installed by default on PFsense, so we need to install it. Go to System > Package Manager > Available Packages and install WireGuard.

Generate keypair and create tunnel

After installing WireGuard, go to VPN > WireGuard > Tunnels and click the Add Tunnel button. Click the Generate button to generate a new keypair. Then, open your tunnels page in 44Net Connect, request a new tunnel, and select your preferred server. In the Public Key field, paste the public key generated in PFsense, then click Create Tunnel to save. Retain the wg-quick WireGuard config for use in later steps.

Fill in interface

Copy the interface addresses from your config file into the Interface Addresses section in your PFsense WireGuard tunnel configuration. Adding the IPv6 address is optional but recommended. If you're doing so, click the Add Address button to add another IP address field. For all entries, use the drop-down menu to configure the subnet. For the IPv4 address it should be /32, and for the IPv6 address it should be /64. There are some places on 44Net Connect that are labeled in a confusing way, and could be interpreted as your tunnel being allocated a /24 for IPv4, but a tunnel will always receive a /32 for IPv4.

Click Save Tunnel. PFsense won't let you add peers until you save the tunnel. In the next step, we'll edit the tunnel to add a peer.

Add Peer

Click the Add Peer button. Uncheck the Dynamic Endpoint box, as this will allow us to fill in a static IP and port for the endpoint. Fill in the endpoint IP and port from the [Peer] section of the WireGuard config file. Also copy in MTU, Keep Alive interval, the peer's public key, and if applicable, the pre-shared key.

Fill in the Allowed IPs section at the bottom using the values from the config file, which by default is 0.0.0.0/0 and ::/0. This configuration allows all addresses, and will let you pass all traffic through the tunnel. If you want only traffic to and from your 44Net IP to go through the tunnel, change your AllowedIPs to 44.0.0.0/9 and 44.128.0.0/10.

Enable WireGuard

Go to VPN > WireGuard > Settings and check the Enable WireGuard box, then save your changes. If prompted with a banner at the top to save your WireGuard settings before applying, do so. Check the status of your tunnel by going to Status > WireGuard, clicking the arrow next to your tunnel to expand its section, and verifying that it's performed a handshake with the endpoint.