WireGuard VPN Tunnel — Take Your Home Protection With You

📡 Full Tunnel Traffic Path

Your Device (phone / laptop / tablet)
    ↓  [encrypted WireGuard tunnel over 4G, public Wi-Fi, etc.]
Your Home Router (UDM Pro / pfSense / OPNsense)
    ↓  IDS/IPS inspects and filters traffic
    ↓
Pi-hole (192.168.0.100) — DNS filtering + blocklists active
    ↓
Unbound — recursive private DNS resolution
    ↓
Internet

Every DNS query from your device is answered by Pi-hole, just as if the device were on your home Wi-Fi. Every blocked domain stays blocked. Content filters apply. Access schedules apply.

Step 1: Create the WireGuard Server

1. Log in to your UniFi Network application (usually at https://192.168.0.1 or via unifi.ui.com)
2. Go to Settings → VPN → VPN Server
3. Click Create New and select WireGuard
4. Give it a name — e.g. HomeVPN
5. The UDM Pro generates a key pair automatically — no need to copy it at this stage, it is embedded in client configs automatically
6. Set Listen Port to 51820 (UDP)
7. Set Tunnel IP to 10.10.10.1/24 — this is the router's address inside the VPN subnet
8. Click Save

UniFi automatically creates all required firewall policies in the policy engine for this VPN server. The WireGuard network is assigned to the VPN zone automatically.

Step 2: Configure DDNS (If No Static IP)

1. First, register a free subdomain at duckdns.org — e.g. myhome.duckdns.org
2. In UniFi Network, go to Settings → Internet → Dynamic DNS
3. Click Add Dynamic DNS
4. Select DuckDNS as the provider
5. Enter your subdomain and DuckDNS token (found in your DuckDNS account dashboard)
6. Save — UniFi updates DuckDNS automatically whenever your WAN IP changes

Your endpoint address for all client configs will be: myhome.duckdns.org:51820

Step 1: Add a Client in UniFi

1. Go to Settings → VPN → WireGuard → HomeVPN
2. Click Add Client
3. Enter a name for the device — e.g. iPhone-15 or Pixel8
4. Set the Client Tunnel IP to an address in your VPN subnet — e.g. 10.10.10.2/32 for the first mobile device
5. Set Allowed IPs to 0.0.0.0/0 — this routes all traffic through the tunnel (see Split-Tunnelling if you prefer selective routing)
6. Set DNS to 192.168.0.100, 1.1.1.1 (Pi-hole primary, Cloudflare fallback — see Section 9)
7. Click Save — UniFi displays a QR code

Step 2: Scan the QR Code on Your Phone

1. Install the WireGuard app on your phone from the App Store (iOS) or Google Play (Android)
2. Open the WireGuard app and tap + → Scan QR Code
3. Point the camera at the QR code shown in UniFi — the profile imports automatically
4. Give the tunnel a name when prompted — e.g. Home Network
5. Tap the toggle to activate the tunnel

Step 1: Create the Client Profile

1. Go to Settings → VPN → WireGuard → HomeVPN → Add Client
2. Name the client — e.g. MacBook-Pro or WorkLaptop
3. Assign a tunnel IP — e.g. 10.10.10.3/32 (increment for each new device)
4. Set Allowed IPs to 0.0.0.0/0
5. Set DNS to 192.168.0.100, 1.1.1.1
6. Instead of the QR code, click Download Configuration — save the .conf file

Step 2: Import on Windows

1. Download and install WireGuard from wireguard.com/install
2. Open the WireGuard app → click Import Tunnel(s) from File
3. Select the .conf file you downloaded
4. Click the Activate button to connect

Step 2: Import on macOS

1. Install WireGuard from the Mac App Store
2. Open WireGuard → File → Import Tunnel(s) from File
3. Select the .conf file
4. Click Activate to connect

Step 2: Import on Linux

1. Install WireGuard: sudo apt install wireguard (Debian/Ubuntu)
2. Copy the config file to /etc/wireguard/: sudo cp homeVPN.conf /etc/wireguard/wg0.conf
3. Start the tunnel: sudo wg-quick up wg0
4. To start automatically on boot: sudo systemctl enable wg-quick@wg0
5. To stop: sudo wg-quick down wg0

Step 1: Install the WireGuard Package (pfSense)

1. Log into your pfSense web interface
2. Go to System → Package Manager → Available Packages
3. Search for WireGuard and click Install
4. Wait for installation to complete, then go to VPN → WireGuard

Step 2: Create the Tunnel (pfSense)

1. Go to VPN → WireGuard → Tunnels → Add Tunnel
2. Check Enable Tunnel
3. Set Listen Port to 51820
4. Click Generate to create a key pair — note the Public Key as you'll need it for client configs
5. Set Interface Address to 10.10.10.1/24
6. Click Save Tunnel

Step 3: Firewall and NAT Rules (pfSense)

1. Go to Interfaces → Assignments — assign the new WireGuard interface and enable it
2. Go to Firewall → NAT → Outbound — add a rule to masquerade traffic from 10.10.10.0/24 going out the WAN interface
3. Go to Firewall → Rules → WireGuard interface — add a pass rule to allow traffic from 10.10.10.0/24
4. Go to Firewall → Rules → WAN — add a rule to allow UDP port 51820 inbound

Step 1: Create the WireGuard Instance (OPNsense)

1. Log into your OPNsense web interface
2. Go to VPN → WireGuard → Local and click +
3. Check Enabled
4. Set a Name — e.g. HomeVPN
5. Set Listen Port to 51820
6. Click the gear icon to generate keys — note the Public Key
7. Set Tunnel Address to 10.10.10.1/24
8. Click Save

Step 2: Assign Interface and Firewall Rules (OPNsense)

1. Go to VPN → WireGuard → General — check Enable WireGuard and save
2. Go to Interfaces → Assignments — find the WireGuard interface in the list and assign it
3. Enable the interface and save
4. Go to Firewall → Rules → WAN — add a pass rule for UDP port 51820
5. Go to Firewall → Rules → WireGuard interface — add a pass rule for traffic from 10.10.10.0/24
6. Go to Firewall → NAT → Outbound — ensure the WireGuard subnet is included in outbound NAT rules

Generate Keys on Linux / macOS

# Generate a private key and derive the public key from it
wg genkey | tee client_private.key | wg pubkey > client_public.key

# View the keys
cat client_private.key   # Keep this secret — goes in client config
cat client_public.key    # Share this with the router — goes in peer config

Generate Keys Using the WireGuard App (Windows / Mobile)

On Windows: open the WireGuard app → click the dropdown arrow next to Add Tunnel → Add empty tunnel. The app generates a key pair automatically and shows the public key at the top.

On Android/iOS: open WireGuard → tap + → Create from scratch. Tap Generate key pair. Note the public key — you will enter it into the router's peer configuration.

Add a Peer (Client) on pfSense

1. Go to VPN → WireGuard → Peers → Add Peer
2. Set Tunnel to your HomeVPN tunnel
3. Enter the client's Public Key
4. Set Allowed IPs to the tunnel IP for this device — e.g. 10.10.10.2/32
5. Repeat for each device, incrementing the IP each time

Add a Peer (Client) on OPNsense

1. Go to VPN → WireGuard → Peers and click +
2. Check Enabled
3. Set Name — e.g. Pixel8
4. Enter the client's Public Key
5. Set Allowed IPs to 10.10.10.2/32
6. Set Instance to your HomeVPN local instance
7. Save

Client Configuration File Template

[Interface]
# Your device's private key (generated on the device)
PrivateKey = <paste_client_private_key_here>

# This device's address inside the VPN tunnel
Address = 10.10.10.2/32

# DNS: Pi-hole primary, Cloudflare fallback
DNS = 192.168.0.100, 1.1.1.1

[Peer]
# Your router's public key (from pfSense / OPNsense server setup)
PublicKey = <paste_router_public_key_here>

# Your home router's public address and WireGuard port
Endpoint = myhome.duckdns.org:51820

# Route all traffic through the tunnel (full tunnel)
AllowedIPs = 0.0.0.0/0

# Keeps the tunnel alive through NAT — essential for mobile
PersistentKeepalive = 25

Replace the placeholder values with your actual keys and DDNS hostname. For the next device, use 10.10.10.3/32, and so on.

Import on Android

1. Save the config as a .conf file (e.g. homeVPN.conf)
2. Open the WireGuard app → tap + → Import from file or archive
3. Select your .conf file
4. Activate the tunnel with the toggle

Import on iOS (Shortcut: QR Code)

On iOS, you can avoid file transfer by converting the config to a QR code. On a computer, visit qrcode-monkey.com, paste the full config text as the QR content, generate the code, then scan it with the WireGuard app using + → Scan QR Code.

Alternatively, save the .conf file to iCloud Drive and import it via + → Import from file or archive in the WireGuard app.

🔒 UDM Pro: Traffic Management Profiles

1. In UniFi → go to Settings → Profiles → Traffic Management
2. Create a Restrictions profile — e.g. Child Device
3. Enable content category filtering — select categories such as adult content, gambling, social networking, and streaming
4. Assign the profile to your child's device by its MAC address or its WireGuard tunnel IP
5. These restrictions apply whether the device is on your home Wi-Fi or tunnelled in remotely

🔒 pfSense / OPNsense: pfBlockerNG DNSBL

1. Install pfBlockerNG via System → Package Manager
2. Go to Firewall → pfBlockerNG → DNSBL
3. Enable category-level blocking — select adult content, gambling, social media, and other categories as appropriate
4. These DNS-level blocks apply to all devices using Pi-hole or the pfSense DNS resolver as their upstream, including VPN tunnel clients

📅 UDM Pro: Traffic Rules with Schedules

1. Go to Settings → Traffic & Firewall → Traffic Rules
2. Click Create New Rule
3. Set the target device (by IP or device group)
4. Set the Action to Block
5. Under Schedule, define the days and times when internet should be blocked — e.g. Mon–Fri after 21:00
6. Save — the rule applies to the device's tunnel traffic as well as local traffic

How to Switch Between Full and Split Tunnel

In the [Peer] section of any WireGuard client config, change the AllowedIPs line:

# Full tunnel — all traffic through home
AllowedIPs = 0.0.0.0/0

# Split tunnel — only home LAN and VPN subnet
AllowedIPs = 192.168.0.0/24, 10.10.10.0/24

You can maintain two separate client profiles on a laptop — one full tunnel for public Wi-Fi, one split tunnel for home resource access — and switch between them as needed.

Step 1: Update AllowedIPs in Your Laptop's Client Config

Open your WireGuard client config (the .conf file, or edit via the WireGuard app). In the [Peer] section, update AllowedIPs to include both your main LAN subnet and your server VLAN subnet:

[Peer]
PublicKey = <router_public_key>
Endpoint = myhome.duckdns.org:51820
PersistentKeepalive = 25

# Main LAN + server VLAN + VPN tunnel subnet
AllowedIPs = 192.168.0.0/24, 192.168.60.0/24, 10.10.10.0/24

This is a split tunnel — your general internet traffic goes direct, but anything destined for 192.168.0.x, 192.168.60.x, or the VPN subnet routes through the home router. Your broadband upload speed does not become a bottleneck for general browsing.

Step 2: Check Zone Assignments (UniFi Network 9.0+ Policy Engine)

UniFi Network 9.0 and later (including the current 10.x releases) replaced the old firewall rules interface with a zone-based policy engine. Traffic is now controlled by the zone each network belongs to, not by individual interface rules. Before creating any policy, confirm which zones your networks are in.

1. Go to Settings → Zones
2. Confirm your WireGuard VPN server is in the VPN zone — UniFi assigns WireGuard here automatically
3. Confirm your server VLAN (192.168.60.x) is in the Internal zone — this is the default for locally created networks

Check the Zone Matrix (the grid of zones shown on screen). The cell where VPN (source row) meets Internal (destination column) should show Allow All by default. If it does, traffic from your WireGuard tunnel to your server VLAN is already permitted at the zone level — move to Step 3.

Step 2b: Create a Firewall Policy If Access Is Still Blocked

If the zone matrix shows Policies rather than Allow All on the VPN → Internal cell, or if your server VLAN has been placed in a custom zone, you will need to create an explicit allow policy. Follow each field in the order they appear on screen.

1. Go to Settings → Policy Table → Create New Policy
2. Policy type — select Firewall (first option in the list; others are Route, QOS, NAT, DNS, ACL, Port Forward)
3. Source Zone — select VPN
4. Source (address) — leave as Any to apply to all WireGuard clients, or select IP and enter a specific tunnel IP (e.g. 10.10.10.2) to restrict to one device
5. Source Port — leave as Any
6. Action — select Allow
7. Destination Zone — select Internal
8. Destination (address) — select IP → enter 192.168.60.234 to target the specific server only, or leave as Any to allow access to the entire Internal zone
9. Destination Port — leave as Any for full server access, or select Specific → enter 21 to permit FTP only
10. IP Version — leave as IPv4 (already selected by default)
11. Connection State — leave as All
12. Syslog logging — leave unselected
13. Schedule — leave as Always
14. Click Save

Once saved, use the Reorder option in the policy table to place this policy above any existing block policies — rules are evaluated top to bottom and the first match applies.

Step 3: Connect and Access the Server

With the tunnel active and the firewall rule in place, connect to your server exactly as you would at home — using its LAN IP address directly:

# FTP connection example (command line)
ftp 192.168.60.234

# Or in an FTP client (FileZilla, Cyberduck, etc.)
Host: 192.168.60.234
Port: 21
Protocol: FTP (or SFTP if configured)

No special configuration is needed on the server itself. It sees the connection arriving from your tunnel IP (10.10.10.x) via the internal network — indistinguishable from a local connection.

1. Check Your Public IP Has Changed

With the WireGuard tunnel active on your device, visit whatismyip.com in a browser. The IP address shown should be your home broadband IP, not your mobile carrier's IP or the hotel Wi-Fi's public IP. If it still shows your mobile/external IP, the tunnel is not routing traffic correctly — check your AllowedIPs setting and confirm the tunnel is active.

2. Confirm the WireGuard Handshake

In the WireGuard app on your device, the active tunnel should show Last handshake: a few seconds ago (or a recent timestamp). If it shows Never, the device has not successfully connected to your home router. Check:

• Port forwarding on the router (UDP 51820 open and pointing correctly)
• DDNS is resolving to the correct WAN IP — test with ping myhome.duckdns.org
• The router's public key in the client config matches what the server generated
• The server peer config has the correct client public key and allowed IP

3. Check DNS Is Going Through Pi-hole

Open the Pi-hole admin panel at http://192.168.0.100/admin → go to Query Log. With the tunnel active and the device browsing, you should see queries appearing from your device's VPN tunnel IP address (e.g. 10.10.10.2). If no queries appear, the DNS in the client config may be incorrect — verify the Pi-hole IP matches what you entered.

4. Test a Blocked Domain

Try to visit a domain that Pi-hole should be blocking — for example, doubleclick.net (an ad-tracking domain blocked by most default blocklists). It should fail to load. You can also check from a command line:

# On macOS / Linux
dig +short doubleclick.net @192.168.0.100
# Should return: 0.0.0.0

# On Windows (PowerShell)
Resolve-DnsName doubleclick.net
# Should return 0.0.0.0 if Pi-hole is blocking it

5. Confirm DNS Routing (Advanced)

# macOS / Linux — query Pi-hole directly to confirm it's responding
dig +short whoami.cloudflare.com TXT @192.168.0.100

# This query will appear in Pi-hole's query log if DNS is routing correctly