← All guides

pfSense guide

This guide sets up your fixed IP on a pfSense firewall (CE 2.7 or Plus 23.09 or later) with the official WireGuard package. The firewall builds two tunnels, one to each PoP, and fails over automatically if one of them drops. Only the traffic of your fixed IP runs through the tunnels; all other traffic keeps going over your regular WAN.

Your fixed IP arrives on the firewall and is forwarded to a device on your network (LAN_HOST). Do you have several addresses? Then also read Multiple addresses at the bottom.

1. The package

System › Package Manager › Available Packages: install WireGuard.

2. The tunnels

VPN › WireGuard › Tunnels → Add Tunnel, twice:

Field	Tunnel 1	Tunnel 2
Enable	on	on
Description	fixedip1	fixedip2
Listen port	51821	51822
Private key	PRIVATE_KEY	PRIVATE_KEY
Interface addresses	leave empty	leave empty

3. The peers (our tunnel servers)

VPN › WireGuard › Peers → Add Peer, twice:

Field	Peer 1	Peer 2
Tunnel	tun_wg0 (fixedip1)	tun_wg1 (fixedip2)
Endpoint	ENDPOINT_1 port PORT	ENDPOINT_2 port PORT
Keep alive	25	25
Public key	SERVER_PUBLIC_KEY_1	SERVER_PUBLIC_KEY_2
Allowed IPs	0.0.0.0/0 and ::/0	0.0.0.0/0 and ::/0

pfSense does not create routes for Allowed IPs by itself, so your regular internet traffic keeps going over your WAN. Enable WireGuard in VPN › WireGuard › Settings.

4. Interfaces, gateways and the failover group

1. Interfaces › Assignments: assign tun_wg0 and tun_wg1 as FIXEDIP1 and FIXEDIP2.
2. Enable them, IPv4 Configuration Type Static IPv4, address TUNNEL_IP_1 / 32 and TUNNEL_IP_2 / 32, MTU 1420.
3. For each, click Add a new gateway next to IPv4 Upstream gateway: FIXEDIP_GW1 with address SERVER_TUNNEL_IP_1, and FIXEDIP_GW2 with address SERVER_TUNNEL_IP_2.
4. System › Routing › Gateway Groups → Add: name FIXEDIP_FAILOVER, FIXEDIP_GW1 on Tier 1, FIXEDIP_GW2 on Tier 2, Trigger Level Member down.

Because each interface has a gateway, pfSense automatically sends replies back through the tunnel the connection came in on (reply-to).

In System › Routing › Gateways, fix the Default gateway IPv4 to your regular WAN gateway (not Automatic), so pfSense never moves all your traffic to a tunnel.

5. Your fixed IP on the firewall

The fixed IP goes on the loopback, separate from both tunnels. Firewall › Virtual IPs → Add

Field	Value
Type	IP Alias
Interface	Localhost
Address	FIXED_IP / 32

6. Forwarding to your server

Firewall › NAT › Port Forward → Add, once for FIXEDIP1 and once for FIXEDIP2:

Field	Value
Interface	FIXEDIP1 (second rule: FIXEDIP2)
Protocol	TCP
Destination	Single host or alias: FIXED_IP
Destination port range	HTTPS (or the port you need)
Redirect target IP	LAN_HOST
Redirect target port	HTTPS
Filter rule association	Add associated filter rule

Also add a rule on FIXEDIP1 and FIXEDIP2 that allows ping: protocol ICMP, subtype Echo request, source SERVER_TUNNEL_IP_1 and SERVER_TUNNEL_IP_2 respectively. Our tunnel servers ping each tunnel to know which one works; without a reply, we don't send your fixed IP to that tunnel.

7. Outgoing traffic from your fixed IP too (optional)

1. Firewall › NAT › Outbound: choose Hybrid Outbound NAT and add two rules (interface FIXEDIP1 and FIXEDIP2): source LAN_HOST/32, translation address FIXED_IP.
2. Firewall › Rules › LAN: add a rule at the top with source LAN_HOST and, under Advanced Options, gateway FIXEDIP_FAILOVER.

8. IPv6

On FIXEDIP1 and FIXEDIP2, also set IPv6 Configuration Type Static IPv6 with TUNNEL_IP6_1 / 128 and TUNNEL_IP6_2 / 128, with SERVER_TUNNEL_IP6_1 and SERVER_TUNNEL_IP6_2 as the IPv6 Upstream gateway, and create a second gateway group for IPv6 with the same tiers. Set IPV6_LAN::1/64 as a static IPv6 address on a LAN interface and have the Router Advertisements announce that subnet. Use the IPv6 group as the gateway in a LAN rule with source IPV6_LAN::/64.

Multiple addresses

Do you have a subnet (FIXED_SUBNET)? Then you can use it in two ways:

• Through your firewall (all addresses usable): put each address as a Virtual IP on Localhost and create port forwards per address as in step 6.
• Directly on your network: put the subnet on its own interface or VLAN with the first usable address as the interface address. On that interface, add a rule with gateway FIXEDIP_FAILOVER, and on FIXEDIP1/FIXEDIP2 the rules for whatever may come in.

Checking

• Status › WireGuard: both peers should show a recent handshake.
• Status › Gateways: both gateways are Online.
• Test from outside, for example with your phone on mobile data: https://FIXED_IP should end up at your server.

Testing failover: briefly disable tunnel fixedip1. FIXEDIP_GW1 goes Offline and the traffic runs via PoP 2. Then enable the tunnel again.

Rolling back

Remove in reverse order: the NAT and firewall rules, the Virtual IP, the gateway group, the interface assignments and the gateways, and finally the peers and the tunnels.

Problems?

• No handshake: check ENDPOINT_1/ENDPOINT_2, PORT and the keys.
• Gateway stays Offline even though there is a handshake: check the gateway address (SERVER_TUNNEL_IP_1/_2).
• Handshake OK, but connections hang: set the MTU of both interfaces to 1360 and the MSS to 1320.
• All your traffic suddenly goes through a tunnel: the default gateway is set to Automatic; fix it to your WAN.

Stuck? E-mail us at info@fixedip.be