OPNsense
VPN
Protect every device at home, smart TVs and consoles too, with IPHush on your OPNsense. Load the WireGuard file from your account, then choose one device or the whole network. Zero connection logs.
OPNsense VPN at a glance
How to set up IPHush on OPNsense
1 · Before you start
- Save a backup of the router’s settings
System → Configuration → Backups → Download configuration
- Keep a way back in
Keep a cable to the router and its admin password at hand while you change it.
2 · Your file
- Make the file for your router
Sign in at iphush.com/app, open Devices, add a Router and choose OPNsense. The app makes IPHush.conf for your router and shows this guide with your own values filled in.
3 · Add the tunnel
- The instance
VPN → WireGuard → Instances → + → Name: IPHush → Private key: from IPHush.conf → Tunnel address: the Address line of the file → Disable routes: on → Save
OPNsense has no file import: copy the values from IPHush.conf. “Disable routes” keeps the tunnel from taking over the default route.
- The peer
VPN → WireGuard → Peers → + → Name: IPHush → Public key from the file → Endpoint [server].pop.iphush.com port 51900 → Allowed IPs 0.0.0.0/0, ::/0 → Keepalive 25 → Instance: IPHush → Save
- Enable and assign
VPN → WireGuard → General → Enable WireGuard → Apply
Then Interfaces → Assignments → assign the WireGuard device, enable it, name it IPHUSH, MTU 1280.
- See the handshake
VPN → WireGuard → Status shows a recent handshake.
4 · Choose who uses it
One device
Only the devices you choose use IPHush; the others keep your normal connection.
- A gateway on IPHush
- NAT out of IPHush
- Send the device through it
- TCP MSS for MTU 1280
- IPv6: no leak
The whole network
Every device on the network uses IPHush. The order matters: the router must reach the IPHush server outside the tunnel before the default route moves into it.
- Keep the IPHush server on your normal connection · System → Routes → Configuration → Add → Network: the address of [server].pop.iphush.com /32 → Gateway: your WAN gateway
- Default route through IPHush · System → Gateways → Configuration → Add → Interface: IPHUSH → IP address: 10.96.0.1 → Far gateway: on
- NAT out of IPHush · Firewall → NAT → Outbound → Hybrid → Add → Interface: IPHUSH → Source: LAN net → Translation: Interface address
- DNS through IPHush · System → Settings → General → DNS servers: 10.96.0.1, gateway IPHUSH
- TCP MSS for MTU 1280 · Interfaces → IPHUSH → MSS: 1240
- IPv6: no leak · Interfaces → LAN → IPv6 Configuration Type: None
- Optional kill switch · Firewall → Settings → Advanced → Skip rules when gateway is down: on
5 · Check it works
- The tunnel is up
VPN → WireGuard → Status shows a recent handshake.
- Check from a device
On a device that should use IPHush, open https://whoami.iphush.com/ in a browser. It must show "iphush": true and an IPHush address. A device outside the option you chose shows false: that is expected.
OPNsense VPN: questions
Which OPNsense firmware works with IPHush?
OPNsense 24.1 or newer.
Can the whole home go through IPHush on OPNsense?
Every device on the network uses IPHush. The order matters: the router must reach the IPHush server outside the tunnel before the default route moves into it.
Is there a kill switch on OPNsense?
Your choice: with it, the LAN rule never falls back to WAN while IPHush is down.
Which plan includes a router?
Family and Pro each include 1 router, and the router counts as one connection: every device behind it is protected. On Pro it leaves from your dedicated IP.
Has IPHush tested these steps on OPNsense?
The steps follow the vendor’s current documentation; we have not yet run them on this router in our lab, and the guide in your account says so. Menu names can differ slightly between firmware versions.
More routers
Every device at home, one router
Family and Pro include a router and all 57 locations.