Pin the pfSense default gateway before assigning a WireGuard interface

Leaving Automatic selected can make the new tunnel an unintended default route.

Source facts

Netgate’s assignment procedure instructs administrators to select a specific default gateway or group rather than Automatic. It warns that Automatic can select the WireGuard interface as default. Assignment creates a dedicated rule tab and enables interface selection for NAT and other features. The documented MTU must account for tunnel overhead on the actual underlying circuit.

Source: Netgate — Assign a WireGuard Interface.

Applicability

This concerns pfSense WireGuard interface assignment.

DSE recommendation

DSE recommends capturing the current IPv4 and IPv6 default routes and deciding their intended values before adding the assigned tunnel. Keep a management path outside the tunnel during the change. Calculate an appropriate MTU from the real underlay rather than copying an Ethernet example onto a smaller circuit. Review NAT and interface rules after assignment because the new interface becomes selectable in additional places. Make the selected default gateway a pre-assignment checkpoint with an independent observer. After assignment, test a destination intended for the tunnel and an ordinary Internet destination. Preserve the route comparison with the interface record so a later reassignment can repeat the same check.

Verification

In an approved rehearsal, compare the default route before and after assignment and confirm ordinary Internet traffic still uses its intended path. Test the tunnel with representative packet sizes and a real application transaction. Verify that only approved destinations use the new interface and retain the route and MTU evidence with the configuration.

Official reference

Netgate — Assign a WireGuard Interface. Reviewed October 20, 2026.