← All guides

OPNsense guide

This guide sets up your fixed IP on an OPNsense firewall (version 24.1 or later; WireGuard is built in there). The firewall builds two tunnels, one to each PoP, and fails over automatically if one of them drops. Only the traffic of your fixed IP runs through the tunnels; all other traffic keeps going over your regular WAN.

Your fixed IP arrives on the firewall and is forwarded to a device on your network (LAN_HOST). Do you have several addresses? Then also read Multiple addresses at the bottom.

1. The peers (our tunnel servers)

VPN › WireGuard › Peers → +, twice:

Field	Peer 1	Peer 2
Name	fixedip1	fixedip2
Public key	SERVER_PUBLIC_KEY_1	SERVER_PUBLIC_KEY_2
Allowed IPs	0.0.0.0/0, ::/0	0.0.0.0/0, ::/0
Endpoint address	ENDPOINT_1	ENDPOINT_2
Endpoint port	PORT	PORT
Keepalive interval	25	25

2. The instances (your side)

VPN › WireGuard › Instances → + (turn on advanced mode), twice:

Field	Instance 1	Instance 2
Name	fixedip1	fixedip2
Private key	PRIVATE_KEY	PRIVATE_KEY
Listen port	51821	51822
MTU	1420	1420
Tunnel address	TUNNEL_IP_1/32	TUNNEL_IP_2/32
Peers	fixedip1	fixedip2
Disable routes	on	on

Disable routes is important: otherwise OPNsense sends all your traffic through the tunnels. Then turn on Enable WireGuard at the top and click Apply.

3. Interfaces, gateways and the failover group

1. Interfaces › Assignments: assign both wg devices as FIXEDIP1 and FIXEDIP2. Enable them, IPv4 Configuration Type None.
2. System › Gateways › Configuration → +, twice:

Field	Gateway 1	Gateway 2
Name	FIXEDIP_GW1	FIXEDIP_GW2
Interface	FIXEDIP1	FIXEDIP2
IP address	SERVER_TUNNEL_IP_1	SERVER_TUNNEL_IP_2
Far Gateway	on	on
Disable Gateway Monitoring	off	off

3. System › Gateways › Group → +: name FIXEDIP_FAILOVER, FIXEDIP_GW1 on Tier 1, FIXEDIP_GW2 on Tier 2, Trigger Level Member down.

Check in System › Settings › General that your regular WAN gateway remains the default gateway.

4. Your fixed IP on the firewall

The fixed IP goes on the loopback, separate from both tunnels. Interfaces › Virtual IPs › Settings → +

Field	Value
Mode	IP Alias
Interface	Loopback
Network / Address	FIXED_IP/32

5. Forwarding to your server

Firewall › NAT › Port Forward → +, once for FIXEDIP1 and once for FIXEDIP2:

Field	Value
Interface	FIXEDIP1 (second rule: FIXEDIP2)
Protocol	TCP
Destination	Single host: FIXED_IP
Destination port range	HTTPS (or the port you need)
Redirect target IP	LAN_HOST
Redirect target port	HTTPS
Filter rule association	Add associated filter rule

Then open the rules OPNsense created itself under Firewall › Rules › FIXEDIP1 and FIXEDIP2, click advanced and set reply-to to FIXEDIP_GW1 and FIXEDIP_GW2 respectively. That way replies go back through the tunnel the connection came in on.

Also add a rule on FIXEDIP1 and FIXEDIP2 that allows ping: protocol ICMP, type Echo Request, source SERVER_TUNNEL_IP_1 and SERVER_TUNNEL_IP_2 respectively. Our tunnel servers ping each tunnel to know which one works; without a reply, we don't send your fixed IP to that tunnel.

6. Outgoing traffic from your fixed IP too (optional)

1. Firewall › NAT › Outbound: set the mode to Hybrid and add two rules (interface FIXEDIP1 and FIXEDIP2): source LAN_HOST/32, translation FIXED_IP.
2. Firewall › Rules › LAN: add a rule at the top: source LAN_HOST, destination any, and under advanced gateway FIXEDIP_FAILOVER.

7. IPv6

Add the IPv6 tunnel address to both instances (TUNNEL_IP6_1/128, TUNNEL_IP6_2/128), create two IPv6 gateways (SERVER_TUNNEL_IP6_1 on FIXEDIP1, SERVER_TUNNEL_IP6_2 on FIXEDIP2, Far Gateway on) and a second failover group with the same tiers. Set IPV6_LAN::1/64 as a static IPv6 address on a LAN interface, have the Router Advertisements announce that subnet, and use the IPv6 group as the gateway in a LAN rule with source IPV6_LAN::/64.

Multiple addresses

Do you have a subnet (FIXED_SUBNET)? Then you can use it in two ways:

• Through your firewall (all addresses usable): put each address as a Virtual IP on the loopback and create port forwards per address as in step 5.
• Directly on your network: put the subnet on its own interface or VLAN with the first usable address as the interface address. On that interface, add a rule with gateway FIXEDIP_FAILOVER, and on FIXEDIP1/FIXEDIP2 rules with the correct reply-to for whatever may come in.

Checking

• VPN › WireGuard › Status: both peers should show a recent handshake.
• System › Gateways › Configuration: both gateways are Online.
• Test from outside, for example with your phone on mobile data: https://FIXED_IP should end up at your server.

Testing failover: briefly disable instance fixedip1. FIXEDIP_GW1 goes Offline and the traffic runs via PoP 2. Then enable the instance again.

Rolling back

Remove in reverse order: the NAT and firewall rules, the Virtual IP, the gateway group and the gateways, the interface assignments, and finally the instances and the peers.

Problems?

• No handshake: check ENDPOINT_1/ENDPOINT_2, PORT and the keys.
• Gateway stays Offline even though there is a handshake: check the gateway's IP address (SERVER_TUNNEL_IP_1/_2) and whether Far Gateway is on.
• Handshake OK, but connections hang: set the MTU of both instances to 1360 and the MSS of the interfaces to 1320.
• Incoming traffic arrives but nothing goes back: the reply-to on the firewall rule is missing.

Stuck? E-mail us at info@fixedip.be