06-22-2026, 09:46 AM
Following up on this since I've now been running WireGuard directly on an OPNsense box for about three weeks.
The setup took maybe 2 hours including reading documentation - much less than I expected. Key things that helped:
Performance is noticeably better than my old OpenVPN setup. File transfers to my NAS over the VPN are significantly faster. Latency overhead is almost undetectable.
One thing to watch: WireGuard by design keeps the peer endpoint IP in memory and doesn't re-authenticate if the IP changes. This is fine for static server IPs but something to be aware of if your VPS IP changes.
The setup took maybe 2 hours including reading documentation - much less than I expected. Key things that helped:
- OPNsense has a WireGuard plugin (os-wireguard) that handles most of the complexity
- The peer configuration exports as a QR code which you can scan directly into the mobile WireGuard app
- Split tunneling (routing only specific traffic through the VPN) is trivial to configure - just change the AllowedIPs on the client
Performance is noticeably better than my old OpenVPN setup. File transfers to my NAS over the VPN are significantly faster. Latency overhead is almost undetectable.
One thing to watch: WireGuard by design keeps the peer endpoint IP in memory and doesn't re-authenticate if the IP changes. This is fine for static server IPs but something to be aware of if your VPS IP changes.