Hello,
I have just set up VPN Wireguard and I can connect to my LAN, but then I lose connection to the internet, but I can ping fex. 8.8.8.8
As DNS Server i've got ADGuard installed on OPNsense
In FW LOG i can see something like that:
https://i.imgur.com/0xfytfk.png (https://i.imgur.com/0xfytfk.png)
I have a similar issue, let me know if you fix it.
is there a wireguard interface or an outbound nat rule?
See more details here in this guide:
https://homenetworkguy.com/how-to/configure-wireguard-opnsense/ (https://homenetworkguy.com/how-to/configure-wireguard-opnsense/)
Is configured as interface. I think I got similar configuration as in this manual. DNS is on firewall itself. Adguard
Please show the servers and clients config, mask the keys but leave the first there characters to see if the keys are in the corect place.
Thank you for the help! Screenshots attached.
and some screenshots more
FW Rules:
The firewall rules... is this WG interface? The rules looks pretty weird...
1. The "WG allow internet" rule is last match, causing that "reject private networks" will be hit before
2. "allow S21" and "allow surface" rule´s source is a host IP, but you´re using /24 instead of /32 (but should not be the problem)
3. there are two DNS rules. Why? 192.168.10.1 is "this firewall" / the sense´s LAN IP, correct? Use the sense´s WG IP instead (192.168.20.1 I guess)
This are the rules for my WG (Roadwarrior) interface for reference:
(https://forum.opnsense.org/index.php?action=dlattach;topic=30171.0;attach=24036)
For Windows client use allowed IPs / erlaubte IPs ) = 0.0.0.0/1, 128.0.0.0/1 as Windows don´t like to change the default route 0.0.0.0/0
Quote from: tiermutter on October 21, 2022, 06:28:54 AM
The firewall rules... is this WG interface? The rules looks pretty weird...
1. The "WG allow internet" rule is last match, causing that "reject private networks" will be hit before
2. "allow S21" and "allow surface" rule´s source is a host IP, but you´re using /24 instead of /32 (but should not be the problem)
3. there are two DNS rules. Why? 192.168.10.1 is "this firewall" / the sense´s LAN IP, correct? Use the sense´s WG IP instead (192.168.20.1 I guess)
This are the rules for my WG (Roadwarrior) interface for reference:
(https://forum.opnsense.org/index.php?action=dlattach;topic=30171.0;attach=24036)
1. This is intentional - I followed the manual on: https://www.youtube.com/watch?v=kYFNa_zpeII (https://www.youtube.com/watch?v=kYFNa_zpeII) . It is explained in about 14''. It works in my config also in another interfaces. It is wrong configuration or only another way to block traffic between interfaces and allow internet?
2. Thank you, I corrected the IP Settings.
3. I corrected the rules. I used 192.168.10.1 because I'm ping the firewall I can see that 192.168.10.1 is blocked. (Screenshot attached)
Unfortunately it doesn't work, on SURFACE and SAMSUNG the same behavior. The VPN Connection works, ping to LAN devices works, but there is no interent.
Rules screenshot attached
Quote from: tiermutter on October 21, 2022, 06:33:26 AM
For Windows client use allowed IPs / erlaubte IPs ) = 0.0.0.0/1, 128.0.0.0/1 as Windows don´t like to change the default route 0.0.0.0/0
I tried with 0.0.0.0/1, 128.0.0.0/1 Unfortunately it doesn't work, on SURFACE and SAMSUNG (Android) the same behavior.
QuoteIt is wrong configuration or only another way to block traffic between interfaces and allow internet?
No, it is not really wrong, but you are allowing all traffic explicity for the two configured WG clients and last match you´re allowing any traffic from any...?! Then, you allow DNS with the sense as destination, but this case is already covered with "allow S21/surface to any", so there are some obsolete rules.
QuoteThe VPN Connection works, ping to LAN devices works, but there is no interent.
Is it really traffic to internet that doesn´t work, or is it just DNS not working?
I suggest to clean up the FW rules, maybe start with one rule "allow WG to any" as you are doing nothing else with those rules for the only two clients that can be connected to WG interface. If you need to block something, place those block rules before "allow any", everything first match.
really to say it is only HOMELAB infrastructure, for short test I can do everything:)
One Question- in the manual i read in this manual https://homenetworkguy.com/how-to/configure-wireguard-opnsense/ , that if I create an wg interface - I don't have to create NAT Port forwarding, iand I dont have to config IPc4 in interface settings. It is right?
Quote
I suggest to clean up the FW rules, maybe start with one rule "allow WG to any" as you are doing nothing else with those rules for the only two clients that can be connected to WG interface. If you need to block something, place those block rules before "allow any", everything first match.
I've created this rule and deactivated any else. Now I receive may DNS and ICMP blocks.
Another strange behavior - In firewall I can see many block, but if I set the filter fo Wireguard I can't see the blocks anymore. Maybe there is something with my Interface?
Quoteif I create an wg interface - I don't have to create NAT Port forwarding
Never understood this context... I´ve created an interface to be more flexible with FW rules for multiple WG instances, there was no outband NAT rule defined and one of my WG is only used to route all traffic over VPN, there is only a "allow WG to any" rule, that´s it.
Quoteand I dont have to config IPc4 in interface settings.
WG interface settings should be "none" for v4 and v6.
Now I receive may DNS and ICMP blocks.I can´t see something wrong, except the srouce IP in that rule. Set it to the whole WG net (192.168.20.0/24
MY interfaces and assigment attached
I'm changed the rule source to "Wireguard net" and removed the IPv4 from Wireguard interface settings. To do this I have to deactivate also DHCP on this interface.
Results still the same:
wg1 2022-10-21T11:08:53 192.168.20.21:33888 192.168.20.1:53 udp Default deny / state violation rule
wg1 2022-10-21T11:08:53 192.168.20.21:64906 192.168.20.1:53 udp Default deny / state violation rule
wg1 2022-10-21T11:08:53 192.168.20.21:6700 192.168.20.1:53 udp Default deny / state violation rule
wg1 2022-10-21T11:08:42 192.168.20.21:12967 192.168.20.1:53 udp Default deny / state violation rule
wg1 2022-10-21T11:08:33 192.168.20.21:45439 192.168.20.1:53 udp Default deny / state violation rule
Update - I have to create the any rule in Interface - WireGuard (Group) then FW and DNS is allowed. This interface has been created automatically with the installation of WG.
Ping to FW via VPN works
DNS to FW ist allowed
ping 8.8.8.8 and internet doesn't works
QuoteTo do this I have to deactivate also DHCP on this interface.
There is no need for DHCP on WG interface.
QuoteUpdate - I have to create the any rule in Interface - WireGuard (Group) then FW and DNS is allowed. This interface has been created automatically with the installation of WG.
This was my next question, before I saw your edit... :)
WG (group) are rules for all WG instances, rules defined for each instance (you onlny have one) will be applied to only this instance. (thats the benefit of using interfaces for each WG instance)
Fine, now let´s troubleshoot your WAN connection issues...
Are you connected to WG local via LAN or from external/ WAN? Try from WAN e.g. LTE/5G!
What does a traceroute say? First hop should be the firewalls WG IP (192.168.20.1) followed by an IP of your ISP (not the mobile ISP).
I'm not home at the moment therefore I can try only traceroute from mobile phone. Earlier, I tried both with LAN and LTE and also did not work.
PING: 192.168.20.1 works
Traceroute to 192.168.20.1 - NO response
Traceroute to 8.8.8.8 - only one HOP - 192.168.20.1
No blocks on FW
In about 1 hour I can try from Windows Maschine
I really appreciate your help
QuoteTraceroute to 8.8.8.8 - only one HOP - 192.168.20.1
Fine, traffic is routed over VPN and then.... stucks somewhere. Can´t imagine why for the moment.
I remember I had some issues with a new created WG interface some times ago and I had to create a new one first and then deleted the not working instance, but I can´t remember what kind of problems I had. Maybe creating a new instance will help for you too...?!
The WG instance is definetly running/active? Tried to restart service or the sense?
Yes the istance is running, i tried with OPN Restart. with no success. Do I need the NAT Port Forwarding? How to create new instance, the service is the same - should I create new Interface right?
Now I remember, that I had trouble becoming the new WG instance active... that was fixed by creating a new one, hence I guess this will not help you.
Maybe you should show your actual config of WG FW rules and WG server and client config, maybe we missed something because we are looking at different statuses...
I don´t see a reason for NAT rules, as mentioned, I have none, neither for two WG instances, nor for three OVPN.
Best regards from VPN :) I created new instance and removed the old one. I supposed the problem was in Interface settings. Anyway it works!
Thank you for help, lesson and patience!
:D
Fine... good to hear, sounds like recreating an instance helps in more cases as thought.
So the list for troubleshooting WG seems to be
1. Reboot
2. Recreate... works always :D