This setup provides remote access to a home LAN and to Docker services published through an Unraid server. It uses split tunnelling: only home-network traffic goes through WireGuard; normal internet traffic continues to use the client’s current connection.

Network layout

Purpose Address
Home LAN 10.33.1.0/24
OPNsense LAN 10.33.1.1
Unraid server 10.33.1.10
WireGuard subnet 10.41.1.0/24
OPNsense WireGuard address 10.41.1.1/24
First remote client 10.41.1.2/32
WireGuard port UDP 51820
OPNsense WAN behind the ISP router 192.168.1.10

These values reflect the working configuration.

1. Create the WireGuard instance

In OPNsense, open:

VPN → WireGuard → Instances

Create an instance with:

Setting Value
Enabled Yes
Name HomeWireGuard
Keys Generate a new key pair
Listen Port 51820
Tunnel Address 10.41.1.1/24
MTU 1420
Disable Routes No

Save the instance. Copy its public key for the client configuration, but never disclose its private key.

OPNsense’s road-warrior guide uses a dedicated tunnel subnet and requires the remote peers to be associated with the WireGuard instance. (OPNsense)

2. Create the Windows client peer

Install the official WireGuard client on Windows and create an empty tunnel. The application generates a client private key and public key.

Copy the Windows client’s public key, then create a peer in:

VPN → WireGuard → Peers

Use:

Setting Value
Enabled Yes
Name Windows-Laptop
Public Key Windows client public key
Allowed IPs 10.41.1.2/32
Endpoint Address Empty
Endpoint Port Empty

Return to:

VPN → WireGuard → Instances → HomeWireGuard

Select Windows-Laptop in the Peers field, save and apply.

Finally, enable WireGuard under:

VPN → WireGuard → General

3. Assign the WireGuard interface

Open:

Interfaces → Assignments

Assign the wg0 device and name it:

WG_HOME

Open the new interface and configure:

Setting Value
Enable interface Yes
Prevent interface removal Yes
IPv4 Configuration Type None
IPv6 Configuration Type None

Do not enter 10.41.1.1 here. That address is managed by the WireGuard instance. Assigning the virtual interface provides a dedicated firewall rules section. (OPNsense)

4. Add the firewall rules

Allow WireGuard on WAN

Under:

Firewall → Rules → WAN

Add:

Setting Value
Action Pass
Protocol UDP
Source Any
Destination WAN address
Destination port 51820
Description Allow WireGuard

Allow VPN clients to access the LAN

Under:

Firewall → Rules → WG_HOME

Add:

Setting Value
Action Pass
Protocol Any
Source WG_HOME net
Destination LAN net
Description Allow WireGuard clients to LAN

This permits traffic from 10.41.1.0/24 to 10.33.1.0/24. OPNsense requires one rule to permit the WireGuard listener on WAN and another to permit decrypted client traffic to its intended destinations. (OPNsense)

An optional MSS normalization rule can be added under:

Firewall → Settings → Normalization

Use:

Interface: WireGuard (Group)
Maximum MSS: 1380

5. Forward the port on the upstream router

OPNsense is behind an ISP router, so the OPNsense WAN address should first be given a DHCP reservation:

192.168.1.10

On the upstream router, create this NAT/PAT rule:

Protocol: UDP
External port: 51820
Internal address: 192.168.1.10
Internal port: 51820

There is no need to lower the upstream router’s overall firewall security level.

6. Configure WireGuard on Windows

The Windows tunnel configuration is:

[Interface]
PrivateKey = WINDOWS_CLIENT_PRIVATE_KEY
Address = 10.41.1.2/32
DNS = 10.33.1.1

[Peer]
PublicKey = OPNSENSE_WIREGUARD_PUBLIC_KEY
Endpoint = vpn.example.net:51820
AllowedIPs = 10.33.1.0/24, 10.41.1.0/24
PersistentKeepalive = 25

Replace vpn.example.net with the home public IP address or a dynamic DNS hostname. Do not publish the real endpoint or either private key.

The AllowedIPs entry makes this a split tunnel:

  • 10.33.1.0/24 routes home-LAN traffic through WireGuard.
  • 10.41.1.0/24 routes WireGuard-subnet traffic through the tunnel.
  • General internet traffic does not enter the tunnel.

PersistentKeepalive = 25 can help clients remain reachable when they are behind NAT, although WireGuard recommends enabling it only where needed. (WireGuard)

7. Access Unraid and its containers

Unraid is available at:

10.33.1.10

Docker containers published through Unraid port mappings can be accessed directly using:

http://10.33.1.10:MAPPED_PORT

For example:

http://10.33.1.10:8080

No route to the internal Docker bridge network is required because connections terminate on ports published through the Unraid host address.

8. Test the connection

Test from outside the home network, such as through a mobile hotspot.

After activating the Windows tunnel, check the WireGuard status page for a recent handshake, then test:

10.41.1.1
10.33.1.1
10.33.1.10
10.33.1.10:MAPPED_PORT

Additional devices should each receive their own peer, key pair and address:

Second client: 10.41.1.3/32
Third client:  10.41.1.4/32

Each OPNsense peer must then be added to the HomeWireGuard instance.