Next, create a new manual rule, with the following details: Under Firewall -> NAT -> Outbound, switch the Rule Generation mode to Hybrid (from automatic). Your Local Instance should now look like this: Under Peers, select the name of your newly created endpoint Navigate back to VPN -> WireGuard -> Local, and click edit for your instance. Your Endpoint should look something like this: Endpoint Port: (multihop port from your chosen Mullvad instance).Public Key: (public key from your chosen Mullvad instance).Under VPN -> WireGuard -> Endpoints, and create a new instance, with the following data: Make note of it's name/ proxy address, public key and port. Navigate to and select a WireGuard server that meets your requirements. Go back to your Local Instance, and under Tunnel Address, add both the IPs returned from the above curl command It's linked to your account, so keep it safe. This will give you an output with 2 IP addresses, like: 00.xx.xxx.xx/xx,fc00:bbbb:bbbb:bb00::0:0x00/128$ SSH into your box, and run the following command, where account number is your 16-digit Mullvad key (without dashes), and public key is from your newly created local instance.Ĭurl -sSL -d account= -data-urlencode pubkey= Once your local config is saved, click edit, and a private and public key should have been automatically generated. Tunnel Address: Leave blank for now, we'll come back to this.If you are using a different VPN, use their DNS here instead) DNS Server: 193.138.218.74 (this is Mullvad's privacy DNS service.Under VPN -> WireGuard -> Local, create a new instance which looks like this: Now you can refresh the page, and go to, go to VPN -> Wireguard Navigate to System -> Firmware -> Plug-ins, and select and install 'os-wireguard'. There wasn't a lot of information online about this, so after I'd (finally) got it working, I wrote this step-by-step guide I am new to OPNsense, and got totally stuck on this.

Mullvad wireguard setup