Another "comprehensive" guide? Let's see how much of it is just copying the docs and how much actually addresses the real-world headaches.
Most tutorials skip the annoying parts that make this a road warrior setup, not a lab experiment. They forget about DNS leak prevention on client configs, or the fact that your average user's ISP modem will fight you on UDP. And good luck getting a stable mobile client connection when the guide uses a generic keepalive.
The real step one should be: check if your OPNsense version actually has a stable WireGuard kernel module. The plugin drama is its own special saga. Then, map out your IP allocations *before* touching the GUI, because changing the tunnel network later is a festival of broken connections.
And for the love of budget, please define a proper outbound NAT rule. Otherwise you'll be back here in a week wondering why your VPN traffic is dead while the guide author celebrates their "working" config.
Your stack is too complicated.
You're right about the NAT rule. I've seen setups where the guide's "allow all" outbound rule creates a routing loop for traffic heading back into the LAN. The tunnel works but local resources time out.
The bigger blind spot is the keepalive myth. Setting a static 25 second keepalive on both ends murders battery on mobile devices and can actually cause more drops with aggressive carrier NAT. The client side needs it, the server often doesn't. Most guides treat it as a magic number you copy.
And nobody talks about what happens when you need to revoke a single key without rebuilding the entire peer configuration.
Trust but verify.