pfSense
VPN
Protect every device at home, smart TVs and consoles too, with IPHush on your pfSense. Load the WireGuard file from your account, then choose one device or the whole network. Zero connection logs.
pfSense VPN at a glance
How to set up IPHush on pfSense
1 · Before you start
- Save a backup of the router’s settings
Diagnostics → Backup & Restore → Download configuration as XML
- Keep a way back in
Keep a cable to the router and its admin password at hand while you change it.
2 · Your file
- Make the file for your router
Sign in at iphush.com/app, open Devices, add a Router and choose pfSense. The app makes IPHush.conf for your router and shows this guide with your own values filled in.
3 · Add the tunnel
- Install WireGuard
System → Package Manager → Available Packages → WireGuard → Install
- The tunnel
VPN → WireGuard → Tunnels → Add Tunnel → Description: IPHush → Private key: from IPHush.conf → Save
pfSense has no file import: copy the values from IPHush.conf.
- The peer
VPN → WireGuard → Peers → Add Peer → Tunnel: IPHush → Endpoint [server].pop.iphush.com port 51900 → Keep Alive 25 → Public key and Allowed IPs 0.0.0.0/0, ::/0 from the file → Save
- Enable and assign
VPN → WireGuard → Settings → Enable WireGuard
Then Interfaces → Assignments → add the WireGuard tunnel → enable it, name it IPHUSH, Static IPv4 = the Address from the file, IPv6 = its fd49 address, MTU 1280.
- See the handshake
Status → WireGuard shows a recent handshake.
4 · Choose who uses it
One device
Only the devices you choose use IPHush; the others keep your normal connection.
- A gateway on IPHush
- NAT out of IPHush
- Send the device through it
- TCP MSS for MTU 1280
- IPv6: no leak
The whole network
Every device on the network uses IPHush. The order matters: the router must reach the IPHush server outside the tunnel before the default route moves into it.
- Keep the IPHush server on your normal connection · System → Routing → Static Routes → Add → Destination: the address of [server].pop.iphush.com /32 → Gateway: your WAN gateway
- Default route through IPHush · System → Routing → Gateways → Add → Interface: IPHUSH → Gateway: 10.96.0.1 → Use non-local gateway
- NAT out of IPHush · Firewall → NAT → Outbound → Hybrid → Add → Interface: IPHUSH → Source: LAN subnets → Translation: Interface Address
- DNS through IPHush · System → General Setup → DNS Server: 10.96.0.1, gateway IPHUSH
- TCP MSS for MTU 1280 · Interfaces → IPHUSH → MSS: 1240
- IPv6: no leak · System → Advanced → Networking → Allow IPv6: off
- Optional kill switch · System → Advanced → Miscellaneous → Skip rules when gateway is down: on
5 · Check it works
- The tunnel is up
Status → WireGuard shows a recent handshake.
- Check from a device
On a device that should use IPHush, open https://whoami.iphush.com/ in a browser. It must show "iphush": true and an IPHush address. A device outside the option you chose shows false: that is expected.
pfSense VPN: questions
Which pfSense firmware works with IPHush?
pfSense CE 2.7 or Plus 23.09 or newer, with the WireGuard package.
Can the whole home go through IPHush on pfSense?
Every device on the network uses IPHush. The order matters: the router must reach the IPHush server outside the tunnel before the default route moves into it.
Is there a kill switch on pfSense?
Your choice: with it, the LAN rule never falls back to WAN while IPHush is down.
Which plan includes a router?
Family and Pro each include 1 router, and the router counts as one connection: every device behind it is protected. On Pro it leaves from your dedicated IP.
Has IPHush tested these steps on pfSense?
The steps follow the vendor’s current documentation; we have not yet run them on this router in our lab, and the guide in your account says so. Menu names can differ slightly between firmware versions.
More routers
Every device at home, one router
Family and Pro include a router and all 57 locations.