Connect a WireGuard router

If your router has a WireGuard client, it can be the home side itself. You import one WireGuard config per node and allow the home's site block through the router's firewall. Notes for UniFi, pfSense, OPNsense, MikroTik and OpenWrt.

How it works#

Each node the home is attached to gets its own WireGuard tunnel: a separate config file, a separate key and its own /30 tunnel address. The router is the WireGuard client and dials out to each node, so no port forwarding is needed.

All of a home's tunnel addresses come from one site block, a /26 from 100.64.0.0/10 (shared address space, never used by home LANs), for example 100.64.0.0/26. Your firewall rule allows the whole block, so adding a node later needs no firewall change.

Steps#

1. In the panel, open Homes, choose Add home, pick WireGuard router and your router's vendor. The panel shows the site block and one config per node, as a .conf download and a QR code.
2. Import each config as its own tunnel. Don't merge them into one interface: every node has its own address and key.
3. Don't route other traffic through the tunnels. Each config's AllowedIPs contains only that tunnel's /30, so no default route or gateway is needed.
4. Add a firewall rule: source the site block, destination the server you publish (for example 192.168.1.20:8123), action allow.
5. Enable the tunnels. Each one ticks off in the panel when its node sees a handshake. Apps stay up as long as at least one tunnel is connected.

A config looks like this (keys shortened):

[Interface]
PrivateKey = <generated on the node>
Address = 100.64.0.2/30
DNS = 1.1.1.1
MTU = 1420

[Peer]
PublicKey = <the node's key>
Endpoint = 203.0.113.24:51820
AllowedIPs = 100.64.0.0/30
PersistentKeepalive = 25

The DNS line is only there because UniFi's importer refuses a file without one; ingressd doesn't use it.

UniFi#

1. Settings → VPN → VPN Client → Create New → WireGuard, then upload each config, one client per node. Name each client after its node.
2. Leave policy-based routing off: no devices or networks routed through the clients.
3. Settings → Security → Firewall: create a policy with source zone External and destination zone Internal, source the site block, destination your server's IP and port. UniFi puts VPN client interfaces (wgclt…) in the External zone, not the VPN zone.

pfSense#

1. System → Package Manager → Available Packages → WireGuard → Install, then VPN → WireGuard → Settings → Enable WireGuard.
2. For each config: VPN → WireGuard → Tunnels → Add Tunnel. Paste the PrivateKey from [Interface] (don't generate a new one) and leave the listen port empty. Add a peer with the public key, endpoint and port from [Peer], Allowed IPs as in the file, keepalive 25.
3. Interfaces → Assignments: add each tun_wg device, enable it, IPv4 configuration Static IPv4 with the Address from its config. Leave the upstream gateway on None.
4. Firewall → Rules on each WireGuard interface (or an interface group): pass from the site block to your server, protocol TCP or whatever your service uses.

OPNsense#

1. VPN → WireGuard (built in since 24.1; on older releases install os-wireguard under System → Firmware → Plugins). Tick Enable WireGuard.
2. For each config: under Peers, add the [Peer] public key, endpoint address and port, Allowed IPs as in the file, keepalive 25. Under Instances, add one with the [Interface] PrivateKey (don't generate a new one), tunnel address from Address, no listen port, and select that peer.
3. Interfaces → Assignments: add each wg device and enable it. No IP configuration or gateway is needed.
4. Firewall → Rules on each WireGuard interface: pass from the site block to your server.

MikroTik (RouterOS 7)#

Use a different interface name and listen port for each config:

/interface wireguard add name=ix-fra-1 listen-port=13231 private-key="<PrivateKey>"
/interface wireguard peers add interface=ix-fra-1 public-key="<Peer PublicKey>" endpoint-address=203.0.113.24 endpoint-port=51820 allowed-address=100.64.0.0/30 persistent-keepalive=25s
/ip address add address=100.64.0.2/30 interface=ix-fra-1
/ip firewall filter add chain=forward action=accept src-address=100.64.0.0/26 dst-address=192.168.1.20 protocol=tcp dst-port=8123 comment=ingressd

Move the filter rule above any drop rules in the forward chain. No route or gateway is needed: the node sits inside each /30.

OpenWrt#

1. System → Software: install luci-proto-wireguard (opkg install luci-proto-wireguard, or apk add luci-proto-wireguard on OpenWrt 25), then restart the router.
2. Network → Interfaces → Add new interface, protocol WireGuard VPN, one per config. Use Load configuration… to import the file; on the peer keep Route Allowed IPs on and keepalive 25.
3. Network → Firewall: put the WireGuard interfaces in their own zone (input reject, forward reject, no masquerading), then under Traffic Rules add a forward rule from that zone to lan.

Other routers#

Any WireGuard client that supports several tunnels works: import each config as a separate tunnel, don't route other traffic through them, and allow the site block from the tunnels to your LAN.

If a tunnel never gets a handshake, see troubleshooting.