Configure pfSense as a Full-Tunnel WireGuard Client

Summary

This article demonstrates how to configure pfSense as a WireGuard client for the Core Transit Static IP Service. Upon completion, all LAN client traffic will be routed through the Core Transit WireGuard tunnel using Policy-Based Routing (PBR), while pfSense continues to manage routing decisions through its standard interface configuration.

This deployment method provides a secure full-tunnel configuration for client devices while maintaining a simple and scalable firewall policy.

Diagram

Prerequisites

• pfSense installed
• DHCP server enabled and configured for LAN clients
• Active Internet connection
• WireGuard provisioning details provided by Core Transit

Install the WireGuard Package

Navigate to:

System → Package Manager → Available Packages

Find and install the WireGuard package.

Create the WireGuard Tunnel

Navigate to:

VPN → WireGuard → Tunnels

Create a new tunnel.

Configure the tunnel using the provisioning details provided by Core Transit.

Settings include:

• Description
• Private Key
• Listen Port
• Tunnel Address

Save the tunnel. 

The configuration page should look something like this:

Configure the WireGuard Peer

Navigate to:

VPN → WireGuard → Peers

Create a new peer using the Core Transit provisioning details.

Configure:

• Peer Public Key
• Endpoint Address
• Endpoint Port
• Allowed IPs
• Persistent Keepalive (25 seconds)

Save the configuration.

Assign the WireGuard Interface

Navigate to:

Interfaces → Assignments

Assign the newly created WireGuard tunnel (tun_wg0) as a new interface.

Configure the WireGuard Interface

Configure the WireGuard Interface

Navigate to:

Interfaces → OPT1

Configure the assigned WireGuard interface.

Save the configuration.

Create the WireGuard Gateway

When prompted to create a new gateway, configure it using the Core Transit tunnel.

Save the configuration. Double check the gateway is properly created by navigating to System → Routing → Gateways.

Configure Outbound NAT

Navigate to:

Firewall → NAT → Outbound

Change the Outbound NAT mode to:

Hybrid Outbound NAT

Create a new outbound NAT rule with the following settings.

Save the rule and apply the configuration. The created rule should look something like this:

Configure Policy-Based Routing

Navigate to:

Firewall → Rules → LAN

Edit the default IPv4 LAN allow rule.

Under Advanced Options, configure the Gateway field to use the Core Transit WireGuard gateway created in the previous step.

Save the rule and apply the changes. Once the gateway has been changed the rules should look as follows:

Verify WireGuard Status

Navigate to:

Status → WireGuard

Confirm the following:

• Tunnel status is active.
• The latest handshake updates regularly.
• RX and TX counters continue increasing.

Verify Client Connectivity

Connect a client device to the pfSense LAN interface.

Verify that the client:

• Receives an IP address from the DHCP server.
• Has Internet connectivity.
• Successfully reaches external resources.
• Uses the Core Transit service as its outbound path.

Example verification commands:

ping 1.1.1.1
tracert 1.1.1.1

Configuration Complete

The pfSense firewall is now configured as a Core Transit WireGuard client using Policy-Based Routing. LAN client traffic is securely routed through the Core Transit tunnel while the firewall maintains normal operation and management connectivity.