pfSense / OPNsense Setup

This guide walks through setting up the Get Real IP WireGuard tunnel on pfSense or OPNsense so your entire network routes inbound traffic through your static public IP. The steps are shown for pfSense — OPNsense differences are noted where they apply.

pfSense

WireGuard support was added to pfSense CE 2.5 and pfSense Plus 21.05. If you’re running an older version, upgrade first.

OPNsense

WireGuard requires the os-wireguard plugin. Install it via System → Firmware → Plugins before proceeding. The WireGuard UI is at VPN → WireGuard with separate tabs for Local (your tunnel), Endpoints (the server), and Peers (linking them together).

---

Step 1 — Download your config

From the dashboard, open your tunnel and click Download Config (Full Tunnel). Open the .conf file in a text editor — you’ll need these values for the pfSense fields:

• PrivateKey (under [Interface]) — your WireGuard private key
• Address (under [Interface]) — your static IP (e.g. 134.49.198.16/32)
• PublicKey (under [Peer]) — the server’s public key
• Endpoint (under [Peer]) — the server address (e.g. turnpike.getrealip.net:51834)

---

Step 2 — Add a WireGuard tunnel in pfSense

1. Go to VPN → WireGuard

2. Click Add Tunnel

3. Fill in:

   • Description: Get Real IP
   • Listen Port: Leave blank (pfSense will assign one — outbound only)
   • Interface Keys: Paste the private key from your downloaded config file (the PrivateKey line under [Interface])

4. Click Save Tunnel

Note the Interface name pfSense assigns (e.g. tun_wg0).

OPNsense

In OPNsense, go to VPN → WireGuard → Local and click + to add a new instance. Paste your private key in the Private Key field. Leave Listen Port blank. Save, then go to the Endpoints tab to add the server (next step).

---

Step 3 — Add a peer

Still in VPN → WireGuard, click the Peers tab, then Add Peer:

Field	Value
Tunnel	Select the tunnel you just created
Description	Get Real IP Server
Endpoint	turnpike.getrealip.net
Endpoint Port	51834
Keep Alive	25
Public Key	(server public key from your config/dashboard)
Allowed IPs	0.0.0.0/0

Click Save Peer.

OPNsense

In OPNsense, go to VPN → WireGuard → Endpoints and click +. Fill in the server public key, endpoint hostname, and port. Then go to the Peers tab and click + to create a peer that links your Local instance to the Endpoint. Set Allowed IPs to 0.0.0.0/0.

---

Step 4 — Assign the WireGuard interface

1. Go to Interfaces → Assignments

2. Find the WireGuard tunnel interface in the Available network ports list

3. Click Add, then click the interface name to configure it

4. Set:

   • Enable: ✓ checked
   • Description: GETREALIP (or whatever you prefer)
   • IPv4 Configuration Type: Static IPv4
   • IPv4 Address: Your static IP (e.g. 134.49.198.16) with /32
   • IPv4 Upstream Gateway: Click Add a new gateway, name it GETREALIP_GW, and set the gateway IP to the same static IP

5. Click Save, then Apply Changes

OPNsense

In OPNsense, go to Interfaces → Assignments, select the WireGuard device (e.g. wg0) from the dropdown, and click +. Then click the new interface to configure it — set it to Static IPv4 with your static IP as a /32 and add a gateway the same way.

---

Step 5 — Add a firewall rule on the WireGuard interface

1. Go to Firewall → Rules → GETREALIP (or whatever you named the interface)
2. Click Add
3. Set:
   • Action: Pass
   • Interface: GETREALIP
   • Protocol: Any
   • Source: Any
   • Destination: Any
4. Click Save, then Apply Changes

This allows inbound traffic arriving on the WireGuard interface to pass through.

---

Step 6 — Add an outbound NAT rule

For inbound traffic to reach LAN devices, pfSense needs to NAT traffic from the WireGuard interface onto your LAN.

1. Go to Firewall → NAT → Outbound
2. Switch to Hybrid Outbound NAT mode
3. Click Add to create a new rule:
   • Interface: GETREALIP
   • Source: Your LAN subnet (e.g. 192.168.1.0/24)
   • Translation / Address: Interface Address
4. Click Save, then Apply Changes

---

Step 7 — Port forwarding (optional)

To expose specific services on LAN machines:

1. Go to Firewall → NAT → Port Forward
2. Click Add:
   • Interface: GETREALIP
   • Protocol: TCP (or UDP, or both)
   • Destination: GETREALIP address
   • Destination Port Range: Your service port (e.g. 443)
   • Redirect Target IP: Your LAN device (e.g. 192.168.1.100)
   • Redirect Target Port: Same port
3. Click Save, then Apply Changes

---

Step 8 — Verify

From a device outside your network, try to reach your static IP on the port you forwarded. You can also check from inside:

curl -4 https://api.ipify.org

This should return your Get Real IP static address if your default route goes through the tunnel.

---

Troubleshooting

Tunnel shows “No Handshake” in the peer list:

• Verify the endpoint hostname resolves: Diagnostics → DNS Lookup → turnpike.getrealip.net
• Check that UDP 51834 is allowed outbound on your WAN firewall rules
• Confirm the public key in pfSense matches what’s in your dashboard

Handshake succeeds but traffic doesn’t reach LAN devices:

• Check the outbound NAT rule is correct and applied
• Verify port forward rules have associated firewall rules (pfSense usually creates them automatically — check Firewall → Rules → GETREALIP)
• Check that the target LAN device’s default gateway is pfSense