Install wireguard lite: pkg install wireguard-tools-lite
On the Endpoint that is publicly accessible
Add at the near end of the ipfw rules the wireguard subnet allow rules /root/bin/wireguard-firewall
#!/bin/sh
/sbin/ipfw -q add 60000 deny all from any to me
/sbin/ipfw -q add 61000 allow all from 10.0.0.0/24 to 10.0.0.0/24
Allow communication in the wireguard subnet wireguard_firewall
#!/bin/sh
# PROVIDE: wireguard_firewall
# REQUIRE: wireguard
# KEYWORD: shutdown
. /etc/rc.subr
name="wireguard_firewall"
rcvar="wireguard_firewall_enable"
: ${wireguard_firewall_enable:="NO"}
command="/root/bin/wireguard-firewall"
load_rc_config $name
run_rc_command "$1"
In case of limited connection, use wireguard_mtu