https://mediawiki.comfac.net/index.php?action=history&feed=atom&title=Training%3A_WireGuard 2026-06-05T11:00:29Z Revision history for this page on the wiki MediaWiki 1.45.1 https://mediawiki.comfac.net/index.php?title=Training:_WireGuard&diff=241&oldid=prev 2026-04-23T07:09:24Z

<p>Created page with &quot;__NOTOC__ &lt;div style=&quot;background:#e7f3ff;border:1px solid #a3c6ff;padding:10px;margin-bottom:15px;&quot;&gt; &#039;&#039;&#039;Training Module: WireGuard (Section 7)&#039;&#039;&#039; — pfSense Plus Fundamentals and Practical Application &lt;/div&gt; == Introduction == WireGuard is a very new VPN technology that is entirely stateless. * Tends to be very performant * Lives in the kernel space * Uses “Crypto-Key Routing” * Ensures routing traffic to correct destination * Very little status info — it work...&quot;</p> <p><b>New page</b></p><div>__NOTOC__<br /> <br /> &lt;div style=&quot;background:#e7f3ff;border:1px solid #a3c6ff;padding:10px;margin-bottom:15px;&quot;&gt;<br /> &#039;&#039;&#039;Training Module: WireGuard (Section 7)&#039;&#039;&#039; — pfSense Plus Fundamentals and Practical Application<br /> &lt;/div&gt;<br /> <br /> == Introduction ==<br /> <br /> WireGuard is a very new VPN technology that is entirely stateless.<br /> <br /> * Tends to be very performant<br /> * Lives in the kernel space<br /> * Uses “Crypto-Key Routing”<br /> * Ensures routing traffic to correct destination<br /> * Very little status info — it works or it doesn’t<br /> * Easy roaming between networks<br /> * Endpoint IP always updated<br /> * Configuration may be more time-consuming<br /> <br /> == Simplified Codebase ==<br /> <br /> WireGuard has a dramatically smaller codebase compared to traditional VPN solutions:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Protocol !! Lines of Code<br /> |-<br /> | IPsec || ~ 400,000<br /> |-<br /> | OpenVPN || ~ 600,000<br /> |-<br /> | &#039;&#039;&#039;WireGuard&#039;&#039;&#039; || &#039;&#039;&#039;~ 4,000&#039;&#039;&#039;<br /> |}<br /> <br /> Less Code = Greater Efficiency<br /> <br /> == Rigid Crypto Protocols ==<br /> <br /> WireGuard uses modern, rigidly defined cryptographic protocols:<br /> <br /> * &#039;&#039;&#039;ChaCha20&#039;&#039;&#039; for symmetric encryption, authenticated with &#039;&#039;&#039;Poly1305&#039;&#039;&#039;<br /> * &#039;&#039;&#039;Curve25519&#039;&#039;&#039; for ECDH<br /> * &#039;&#039;&#039;BLAKE2s&#039;&#039;&#039; for hashing and keyed hashing<br /> * &#039;&#039;&#039;SipHash24&#039;&#039;&#039; for hashtable keys<br /> * &#039;&#039;&#039;HKDF&#039;&#039;&#039; for key derivation<br /> <br /> == Site-to-Site ==<br /> <br /> WireGuard creates a local wg0 interface. Peers have their own public &amp; private keys.<br /> <br /> * Exchange public key with peers<br /> * Crypto-key routing — looks up peer wg0 address and public key<br /> * Forwards traffic out local wg0 interface to peer<br /> <br /> == Local Setup ==<br /> <br /> Some assembly required:<br /> <br /> # Activate the service<br /> # Give wg0 a local IP/mask<br /> # Generate Public/Private keys<br /> # Assign wg0 to an OPT interface<br /> # Create a gateway<br /> # Open WG port on firewall<br /> # Create firewall rules to allow traffic<br /> <br /> == Peer Setup ==<br /> <br /> Required information for peer configuration:<br /> <br /> * Peer’s initial end-point IP<br /> * Peer’s public key<br /> * Peer’s wg0 IP (typically same as allowed IPs)<br /> <br /> Assuming peer’s firewall is setup, try ping!<br /> <br /> == Summary ==<br /> <br /> * WireGuard is completely stateless<br /> * Updated crypto protocols<br /> * Uses crypto-key routing — routing table not a factor<br /> * Requires its own OPT interface and gateway<br /> * Very limited status information<br /> * &#039;&#039;&#039;It works, or it doesn’t&#039;&#039;&#039;<br /> <br /> == Next Module ==<br /> * [[Training Lab 7: WireGuard|Lab 7: WireGuard — Site-to-Site VPN Configuration]]<br /> <br /> ----<br /> &lt;small&gt;&#039;&#039;&#039;Source:&#039;&#039;&#039; Netgate pfSense Training — FUND001-LIVE-SLIDE-SEG7-WG.pdf (© 2017 Rubicon Communications dba Netgate)&lt;/small&gt;</div>

Justinaquino