Routing Traffic Through TorGuard in OPNsense

This post took way longer than expected to write. What started as my first post created has now become my fifth one published. There are plenty of tutorials, even official ones, explaining how to configure VPNs, with kill switches and other features I didn't even understand and blindly followed along. After days of troubleshooting, I couldn't get it to work properly, so I tried to configure it in my own way. In this post, I want to show you, how I successfully set up a connection to a VPN, in this case, TorGuard. (not sponsored)

Prerequisites

• You have an up and running OPNsense instance on version 24.7
• You have an active TorGuard subscription, or an existing WireGuard configuration

Preparation (TorGuard)

Before you do anything in OPNsense, you'll need to generate a WireGuard config file. If you already have one, you can go ahead and skip this section. Otherwise, go to the TorGuard config page, then select the following parameters:

Click on Generate Config. The config file will be downloaded automatically and displayed on the site too. In my case it looks like this here:

# TorGuard WireGuard Config
[Interface]
PrivateKey = OK6YIJGSZOVQmQGgm9Vor3Eae22ELTVjcSMwgxis0UY=
ListenPort = 58243
MTU = 1390
DNS = 1.1.1.1
Address = 10.13.88.77/24

[Peer]
PublicKey = ZE6clu3c51cx/RZJgPKRjCf3Bm2QZ+rpHpemDJ1mUCc=
AllowedIPs = 0.0.0.0/0
Endpoint = 2.58.46.138:1443
PersistentKeepalive = 25

Configuring OPNsense

Open the OPNsense web UI, then use the sidebar to go to:

VPN > WireGuard > Instances

Click on the small + button, in the bottom right corner, to add a new WireGuard instance. In the form, enable advanced mode. It's the small toggle in the top left corner and fill out the form:

Save it.

VPN > WireGuard > Peers

Do the the same here as before. Click on the + button, to add a new WireGuard peer, and fill out the form:

Save it. Under the table, check the box for Enable Wireguard and click on Apply.

Interfaces > Assignments

In this step you're gonna assign the created WireGuard instance to an interface. In the table that says Assign a new interface do the following:

Then click on Add.

Interfaces > [WAN_VPN0]

Simply enable the interface and lock it. Nothing else needs to be done here. Save the changes.

System > Settings > General

Disable gateway switching and save the changes.

System > Gateways > Configuration

Add a new gateway:

Save it and Apply changes.

Firewall > NAT > Outbound

Change the mode to Hybrid outbound NAT rule generation, and click on Save.

Now, add a new manual rule and leave everything unchanged, except for the following:

Save and Apply the changes.

Firewall > Rules > LAN

Create a new rule. Leave everything unchanged unless mentioned here:

Save it.

After saving the changes. you'll be redirected to Firewall > Rules > LAN. There, select your created rule (1), and move it above the default rule (2). Then apply the changes (3).

By prioritizing the VPN rule, all the outbound traffic will be routed through it, which acts as a kill switch too. Don't take my word for it though, as any higher prioritized firewall rules can override this behavior.

Selective routing (optional)

In this section, I will show you how you can exclude specific devices from being routed through the VPN gateway. Feel free to skip this step if it's not needed.

Firewall > Aliases

Otherwise, click on the + button to add a new alias. Fill out the form:

Save it, and don't forget to Apply the changes below the table.

Firewall > Rules > LAN

Create a new rule:

Save it.

Select the new created rule and move it above the VPN rule. Then Apply changes.

And you are done!