OPNsense WireGuard Site-to-Site VPN: Step-by-Step With Real Config (2026)
OPNsense WireGuard site-to-site VPN complete guide
Opnsense config screenshots/commands. Here's what that actually involved.
The Setup
Peer config
What I Built
Opnsense config screenshots/commands
Opnsense config screenshots/commands. This is where most implementations go wrong — not in the concept, but in the specifics that documentation tends to gloss over. The version that's actually running in production looks different from what the README describes.
Peer config
Peer config. This is where most implementations go wrong — not in the concept, but in the specifics that documentation tends to gloss over. The version that's actually running in production looks different from what the README describes.
Mtu gotcha
Mtu gotcha. This is where most implementations go wrong — not in the concept, but in the specifics that documentation tends to gloss over. The version that's actually running in production looks different from what the README describes.
What Broke First
Failover consideration. This is the part that took the most time to figure out — not the implementation itself, but the failure mode you only encounter at the wrong moment. The fix is in the tooling, not the concept.
What's Running in Production
The stack: opnsense, wireguard, vpn, networking. Monitoring via Zabbix with a custom alert template. The rule I apply to everything in production: if it can't self-report a failure, it doesn't go in.
Key Takeaways
- Opnsense — OPNsense config screenshots/commands
- Peer — peer config
- Mtu — MTU gotcha
Questions or a different approach? Reply to The Operator's Edge newsletter — I read every response.
Live Life Automated covers the broader philosophy behind how I think about automation and building systems that don't require constant babysitting. Available at mfitz.net.
