pfSense WireGuard Setup Guide
pfSense is FreeBSD-based. WireGuard is available via the package manager. Like OPNsense, NAT is configured through the firewall UI — not via PostUp scripts.
Install the WireGuard package
Go to System → Package Manager → Available Packages. Search for and install pfSense-pkg-WireGuard.
Create a tunnel in ProxyLink
Go to Devices → + Add → Router / LAN site, select Home / LAN Router, enter your LAN subnet, and note all values from the downloaded config.
Create the WireGuard tunnel
Go to VPN → WireGuard → Tunnels → Add Tunnel.
- Description:
ProxyLink - Private Key: from your config
- Listen Port: leave default
Add the ProxyLink server as a peer
Under the tunnel, go to the Peers tab → Add Peer:
- Public Key: server public key
- Endpoint: server IP + port
- Allowed IPs:
10.100.0.0/16 - Keepalive:
25
Assign the interface
Go to Interfaces → Assignments. Assign tun_wg0 as a new interface. Enable it and name it PROXYLINK. Set the IP to your VPN IP with /24.
Configure outbound NAT
Go to Firewall → NAT → Outbound. Switch to Manual mode.
Add a rule: Interface = PROXYLINK, Source = your LAN subnet, Translation = Interface address.
Good to know
What you get once the tunnel is up
- Browser RDP, VNC, and SSH — open a terminal or remote desktop to any device behind the tunnel straight from the ProxyLink dashboard. No client software, no open ports on your side.
- Proxy links — share an HTTPS URL that forwards to any internal web interface (NAS, NVR cameras, PBX admin panels, router UIs) with ProxyLink login in front of it.
- No public exposure — the device keeps zero open ports and needs no static IP. The tunnel is outbound-only WireGuard to EU-hosted infrastructure. Read more about agentless remote access and NIS2 compliance.
Ready to connect?
Create a free account and set up your first tunnel in minutes. Free during early access — no card required.