Please bear with my, I am partially sighted and managed to read my wayn thorugh the WireGuard install.
However there is one part I am totally confused about, and that is this:-
The final piece is to allow traffic from the WireGuard network. First define an alias (e.g. VPN_clients) and include in it the IP addresses (e.g. 10.10.10.2 and 10.10.10.3) or subnet (e.g. 10.10.10.0/24) of the WireGuard clients from which traffic is to be allowed. Do this via Firewall ‣ Aliases (click + in the bottom right).
When I create and alias, it askes for type? Then content? have tried newtork and then the IP's, but it complains they are wrong. Sorry I know this is very basic, but really frustrated and assuming I read something wrong somewhere?
Kind regards Paul.
I have Wireguard working without the use of Alias. And went for the interface solution.
The below websites helped me. I hope they are of any help for you also:
https://homenetworkguy.com/how-to/configure-wireguard-opnsense/ (https://homenetworkguy.com/how-to/configure-wireguard-opnsense/)
https://miha-kralj.medium.com/vpn-with-wireguard-on-opnsense-7bc1d7451a6e (https://miha-kralj.medium.com/vpn-with-wireguard-on-opnsense-7bc1d7451a6e)
https://blog.linuxserver.io/2019/11/16/setting-up-wireguard-on-opnsense-android/ (https://blog.linuxserver.io/2019/11/16/setting-up-wireguard-on-opnsense-android/)
@drifting, if you are looking to include single IPs, use Host(s) as the type, and if you are looking to include a subnet, use Network(s) as the type. You can also put single hosts in Network(s) but have to use CIDR format (/32)
Reading the docs always helps: https://docs.opnsense.org/manual/aliases.html
@RamSense, yes if you define an interface for the wgX device, then you can use the "net" variable that is created for that interface, and don't need to define a separate alias. But defining an interface is optional for a road warrior setup, and if it is not defined it is usually necessary to define an alias rather than using the default "Wireguard net"
@Greenlan: thanks for your answer. Can you tell me why is it better to use created " net" for that interface than the default "Wireguard net" ? What is the difference in opnsense?
Because "Wireguard net" does not work as expected if there are multiple wgX devices and/or multiple endpoints. I don't know why (I haven't been able to find out what is populated in it) but this has tripped up many people. That's why the documentation has been updated
thnx! Excellent to know.