equipment:fw4c_opnsense
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| equipment:fw4c_opnsense [2023/11/20 16:41] – dirk | equipment:fw4c_opnsense [2023/11/25 09:46] (current) – [Wireguard VPN] dirk | ||
|---|---|---|---|
| Line 9: | Line 9: | ||
| * login as ' | * login as ' | ||
| * select keyboard layout, Install (UFS), select harddrive, ok on swap, change password, reboot without USB plugged in. | * select keyboard layout, Install (UFS), select harddrive, ok on swap, change password, reboot without USB plugged in. | ||
| + | |||
| + | Link: https:// | ||
| ===== Connect ===== | ===== Connect ===== | ||
| * plug into the LAN port (see below note for the FW4C) and navigate to 192.168.1.1 | * plug into the LAN port (see below note for the FW4C) and navigate to 192.168.1.1 | ||
| Line 57: | Line 59: | ||
| * Save/Apply | * Save/Apply | ||
| * repeat for other forwarded ports | * repeat for other forwarded ports | ||
| - | * Port Forwarding rules if unraid/ Nginx:< | + | * Port Forwarding rules if unraid/ Nginx:< |
| - | 443 | + | 443 |
| - | 22 Both | + | 22 Both |
| - | * Port Forwarding rules if standalone:< | + | * Port Forwarding rules if standalone:< |
| - | 443 | + | 443 |
| - | 22 Both | + | 22 Both |
| - | 32400 | + | 32400 |
| * Hairpin NAT: | * Hairpin NAT: | ||
| * go to Firewall / Settings / Advanced | * go to Firewall / Settings / Advanced | ||
| * Check " | * Check " | ||
| * Save / Apply | * Save / Apply | ||
| + | |||
| + | ==== Wireguard VPN ==== | ||
| + | === Create Instance and Peers === | ||
| + | * go to System / Firmware / Plugins and install os-wireguard | ||
| + | * go to VPN / WireGuard / Settings / Instances | ||
| + | * create new instance by clicking on the " | ||
| + | * Enabled: check | ||
| + | * Name: WG1 | ||
| + | * click the gear to create a Public/ | ||
| + | * we will call this public key " | ||
| + | * Listen port: 51820 | ||
| + | * Tunnel address: pick a subnet not used elsewhere (10.23.0.1/ | ||
| + | * Save/Apply | ||
| + | * go to VPN / WireGuard / Settings / General and enable WireGuard | ||
| + | * go to VPN / WireGuard / Settings / Peers | ||
| + | * create new peer by clicking on the " | ||
| + | * Enabled: check | ||
| + | * Name: iPhone / Macbook / whatever | ||
| + | * Public key: PEERPUBLIC (put in the key created when you setup the client... see below) | ||
| + | * Allowed IPs: something on the subnet configured above (10.23.0.11/ | ||
| + | * Instances: select above instance (WG1) | ||
| + | * Save/Apply | ||
| + | * go to VPN / WireGuard / Settings / Instances / Edit WG1 | ||
| + | * Add Peers into Peers drop down | ||
| + | * Save/Apply | ||
| + | * go to Lobby / Dashboard and restart wireguard | ||
| + | === Create interface === | ||
| + | * go to Interfaces / Assignments | ||
| + | * in the drop down under new interface, select the WireGuard instance (wg1) | ||
| + | * Enable: check | ||
| + | * Description: | ||
| + | * Save/Apply | ||
| + | * go to Interfaces / WG1 | ||
| + | * Enable: check | ||
| + | * Description: | ||
| + | * Save/Apply | ||
| + | === Create VPN Firewall rules === | ||
| + | * go to Firewall / Rules / WAN | ||
| + | * create new rule by clicking on the " | ||
| + | * Action: Pass | ||
| + | * Quick: check | ||
| + | * Interface: WAN | ||
| + | * Direction: in | ||
| + | * TCP/IP Version: IPv4 | ||
| + | * Protocol: UDP | ||
| + | * Source Invert: unchecked | ||
| + | * Source: any | ||
| + | * Destination Invert: unchecked | ||
| + | * Destination: | ||
| + | * Destination port range: from (other) 51820 to (other) 51820 | ||
| + | * Description: | ||
| + | * Save/Apply | ||
| + | * go to Firewall / Rules / [Name of interface assigned above (WG1)] | ||
| + | * create new rule by clicking on the " | ||
| + | * Action: Pass | ||
| + | * Quick: check | ||
| + | * Interface: WG1 | ||
| + | * Direction: in | ||
| + | * TCP/IP Version: IPv4 | ||
| + | * Protocol: any | ||
| + | * Source Invert: unchecked | ||
| + | * Source [Name of interface assigned above NET (WG1 net)] | ||
| + | * Destination Invert: unchecked | ||
| + | * Destination: | ||
| + | * Destination port range: any | ||
| + | * Save/Apply | ||
| + | === Setup Clients === | ||
| + | * This will differ based on device... principal is the same. | ||
| + | * iPhone | ||
| + | * Download WireGuard from app store | ||
| + | * create new | ||
| + | * Name: brimble.com | ||
| + | * Generate keypair | ||
| + | * This public key (PEERPUBLIC) will go in VPN / WireGuard / Settings / Peers / Public key box | ||
| + | * Addresses: This will be whatever you put in the Allowed IPs box of VPN / WireGuard / Settings / Peers (10.23.0.11/ | ||
| + | * Listen port: Automatic | ||
| + | * MTU: Automatic | ||
| + | * DNS servers: 8.8.8.8, 8.8.4.4 | ||
| + | * click Add peer | ||
| + | * Public key: MAINPUBLIC this will be in VPN / WireGuard / Settings / Instances / Public key box | ||
| + | * Preshared key: blank | ||
| + | * Endpoint: the address and port of your server (brimble.com: | ||
| + | * Allowed IPs: 0.0.0.0/0 | ||
| + | * Save | ||
| + | * macbook | ||
| + | * Downlaod WireGuard from app store | ||
| + | * create new | ||
| + | * Name: brimble.com | ||
| + | * This public key (PEERPUBLIC) will go in VPN / WireGuard / Settings / Peers / Public key box | ||
| + | * < | ||
| + | PrivateKey = whatever is there | ||
| + | Address = This will be whatever you put in the Allowed IPs box of VPN / WireGuard / Settings / Peers (10.23.0.11/ | ||
| + | DNS = 8.8.8.8, 8.8.4.4 | ||
| + | |||
| + | [Peer] | ||
| + | PublicKey = MAINPUBLIC this will be in VPN / WireGuard / Settings / Instances / Public key box | ||
| + | AllowedIPs = 0.0.0.0/0 | ||
| + | Endpoint = the address and port of your server (brimble.com: | ||
| + | </ | ||
| + | * Save | ||
| + | Link: https:// | ||
| + | ==== NAT for online gaming ==== | ||
| + | * go to Firewall / Aliases | ||
| + | * create new alias by clicking on the " | ||
| + | * Enabled: check | ||
| + | * Name: NintendoSwitch | ||
| + | * Type: Host(s) | ||
| + | * Content: IP address of Switch | ||
| + | * Save/Apply | ||
| + | * go to Firewall / NAT / Outbound | ||
| + | * change mode to Hybrid so you can add manual rule | ||
| + | * create new rule by clicking on the " | ||
| + | * Interface: WAN | ||
| + | * Protocol: any | ||
| + | * Source address: NintendoSwitch | ||
| + | * Static-port: | ||
| + | * Give it a description | ||
| + | * Save/Apply | ||
| + | |||
| + | Link: https:// | ||
| ==== Services ==== | ==== Services ==== | ||
| Line 75: | Line 197: | ||
| * Save Apply | * Save Apply | ||
| * Static MAC/IP Mapping< | * Static MAC/IP Mapping< | ||
| - | BrimUpstairsAP | + | BrimUpstairsAP |
| BrimDownstairsAP 10.23.79.6 | BrimDownstairsAP 10.23.79.6 | ||
equipment/fw4c_opnsense.1700520069.txt.gz · Last modified: by dirk
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
