[Zero Two]

Following up on this since I've now been running WireGuard directly on an OPNsense box for about three weeks.

The setup took maybe 2 hours including reading documentation - much less than I expected. Key things that helped:

• OPNsense has a WireGuard plugin (os-wireguard) that handles most of the complexity
  
• The peer configuration exports as a QR code which you can scan directly into the mobile WireGuard app
  
• Split tunneling (routing only specific traffic through the VPN) is trivial to configure - just change the AllowedIPs on the client
  

Performance is noticeably better than my old OpenVPN setup. File transfers to my NAS over the VPN are significantly faster. Latency overhead is almost undetectable.

One thing to watch: WireGuard by design keeps the peer endpoint IP in memory and doesn't re-authenticate if the IP changes. This is fine for static server IPs but something to be aware of if your VPS IP changes.

[Zero Two]

Setting up a VPN for remote access to my home network and I keep going back and forth on the options. Curious what people here are actually running and why.

WireGuard seems like the obvious modern choice - kernel-level on Linux, faster handshakes, smaller codebase (easier to audit), and the configs are tiny. The downside is managing key distribution manually and the lack of dynamic routing out of the box.

OpenVPN is battle-tested and supported everywhere. It's slower and the config files look like XML nightmares but it just works and there's a client for every platform.

Tailscale is interesting because it uses WireGuard under the hood but handles the key exchange and routing automatically via their coordination server. Free tier is generous. The trade-off is you're relying on their servers for control plane stuff - fine for personal use, maybe not for corporate.

I'm leaning toward WireGuard directly on an OPNsense box since I want full control and my use case is simple (a few trusted devices).

What are you running? Any pitfalls to watch out for? Is Tailscale actually worth it for home use or is rolling your own WireGuard not that painful?