Setting Up WireGuard VPN Site-to-Site Connections in NG Firewall

Overview

NG Firewall version 16 and above supports WireGuard® VPN for secure remote access. WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. This article describes how to set up site-to-site VPN tunnels using WireGuard in NG Firewall. To configure mobile devices and desktop systems using the WireGuard app, refer to Setting up WireGuard VPN on mobile devices and desktops.

Getting Started

Install the WireGuard VPN app in the NG Firewall administration. Note that the WireGuard VPN app is included in the NG Firewall Complete subscription.

In the WireGuard App settings, review the Local Networks in the Remote Client Configuration. The local networks specify which subnets get exported in the configuration of VPN tunnels. These subnets become accessible to remote clients in VPN tunnels.

For more details on WireGuard settings refer to the WireGuard wiki.

Adding a Tunnel

WireGuard VPN Tunnels use the following parameters:

To simplify the configuration of VPN Tunnels, NG Firewall enables you to Copy and Paste these parameters when setting up WireGuard VPN tunnels. 

You can copy the configuration in the Tunnel configuration for each endpoint from the Status page of the WireGuard app.

1. In the Tunnels tab, click Add to create a tunnel.
2. In the Description field, Paste the configuration from the remote endpoint.
3. Review the automatically populated fields for accuracy.
4. Modify the Description if necessary.
5. Enter a Monitor IP Address. The remote peer IP address is recommended.
6. Click Done.
7. Click Save to confirm the new tunnel.
8. Repeat these steps on the remote endpoint.

You can verify that the tunnels are connecting from the Status tab. If the tunnels connect successfully, you can see Bytes In and and Bytes Out data and a timestamp of the last handshake.