Firewalla VPN Server supports both OpenVPN and WireGuard VPN. Here is the guide on how to configure WireGuard VPN. If you want to learn more about what Firewalla's VPN server is, please refer to our article on the topic: Firewalla VPN Server.
This feature is available in Firewalla Gold, Purple, and Blue Plus.
WireGuard is a newer (when compared with OpenVPN) VPN protocol, and like OpenVPN, it's also open source. This protocol is simpler than OpenVPN and can have a higher encryption rate. (References:https://wireguard.comhttps://en.wikipedia.org/wiki/WireGuard)
- WireGuard is UDP-based. (OpenVPN can run over TCP/UDP).
- On Firewalla Gold, the performance is 1.5 to 2 times faster than OpenVPN.
- WireGuard source code is new and simpler than OpenVPN.
- Site to Site VPN is supported.
- There is a known issue that causes unstable WireGuard VPN connections if you are in dual-WAN load balancing mode. If it occurs, please contact us at firstname.lastname@example.org.
1. Enable WireGuard
Go to VPN Server on the Firewalla app, and tap the WireGuard button to turn it on.
2. Configure Port Forwarding
Similar to OpenVPN, WireGuard requires the port to be accessed from outside your network.
- If you are using Firewalla in Router mode without double NAT, skip this step. Port Forwarding will be shown as complete.
- If you are using Firewalla in Simple or DHCP mode, and your main router has UPnP enabled (as most routers do), Firewalla will do everything for you. If your router doesn't support UPnP, you will need to manually set up port forwarding on your home router. Tutorial: How to set up port forwarding for VPN Server
3. Connect to Firewalla WireGuard VPN Server
3.1 Using Wireguard App
Step 1: Add Clients
To connect your mobile device or computer to the Firewalla VPN server, you'll need a VPN profile to set up the VPN Connection.
On Firewalla App, tap Setup -> Add a Client, and a client will be created automatically. Tap the client and it will show you a profile and a QR code.
- Up to 12 clients are now supported on the Firewalla VPN Server.
- The client can be removed when you tap the client profile, click scroll down, and click 'Delete This Client'.
- Please do NOT use the same VPN profile on different WireGuard clients at the same time.
Step 2: Set Up The WireGuard App:
To connect to the VPN server, you will need to install the WireGuard app on your mobile or desktop device. Here is the installation guide provided by Wireguard.
There are two ways to use the WireGuard app to connect your device to the WireGuard VPN Server:
- Create from file
- Create from QR code
Here is an example of the WireGuard app on iOS:
3.2 Using Firewalla Site to Site VPN
Site to Site VPN using Wireguard protocol allows you to access shared devices such as file servers, printers, and video cameras bi-directionally between any two sites managed by Firewalla, but with a higher encryption rate and better performance.
To create a Site to Site VPN connection using WireGuard, on the Firewalla app, go to the client side box, find VPN Client -> Create VPN Connection -> Site to Site VPN -> select the server box you'd like to connect -> Select WireGuard.
4. VPN Device Management (Gold & Purple Only)
The WireGuard VPN server creates a local network on Firewalla, and all the devices will join the network once connected to VPN. Each VPN device corresponds to a VPN client you created in the VPN server setup.
On the Devices list, tap the WireGuard network or a VPN device. You can view the network flows and basic info, receive alarms, and apply rules or features to the entire VPN network or to any VPN device individually, just like any other local device.