I set up a wireguard-server on my opnsense with access to the LAN for clients.
What is very strage, is, that the wireguard-client can ping (and access) some of LAN-clients and other not.
The opnsense can ping all of the clients in the LAN.
Also a traceroute from the wireguard-client is strange.
A traceroute from the wireguard to the opnsenses LAN-Address doesn't work, a ping does.
A trace route from the wireguard-client to a pingable LAN-IP shows stars iin the first hop.
pings from opnsense (192.168.101.100):root@OPNsenseNew:/conf # ping -c 3 192.168.101.100
PING 192.168.101.100 (192.168.101.100): 56 data bytes
64 bytes from 192.168.101.100: icmp_seq=0 ttl=64 time=0.074 ms
64 bytes from 192.168.101.100: icmp_seq=1 ttl=64 time=0.110 ms
64 bytes from 192.168.101.100: icmp_seq=2 ttl=64 time=0.116 ms
--- 192.168.101.100 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.074/0.100/0.116/0.019 ms
root@OPNsenseNew:/conf # ping -c 3 192.168.101.56
PING 192.168.101.56 (192.168.101.56): 56 data bytes
64 bytes from 192.168.101.56: icmp_seq=0 ttl=64 time=0.550 ms
64 bytes from 192.168.101.56: icmp_seq=1 ttl=64 time=0.514 ms
64 bytes from 192.168.101.56: icmp_seq=2 ttl=64 time=0.218 ms
--- 192.168.101.56 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.218/0.427/0.550/0.149 ms
root@OPNsenseNew:/conf # ping -c 3 192.168.101.200
PING 192.168.101.200 (192.168.101.200): 56 data bytes
64 bytes from 192.168.101.200: icmp_seq=0 ttl=64 time=0.285 ms
64 bytes from 192.168.101.200: icmp_seq=1 ttl=64 time=0.278 ms
64 bytes from 192.168.101.200: icmp_seq=2 ttl=64 time=0.235 ms
--- 192.168.101.200 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.235/0.266/0.285/0.022 ms
ping from wireguard client:root@debiantesting:~# ping -c 3 192.168.101.100
PING 192.168.101.100 (192.168.101.100) 56(84) bytes of data.
64 bytes from 192.168.101.100: icmp_seq=1 ttl=64 time=24.9 ms
64 bytes from 192.168.101.100: icmp_seq=2 ttl=64 time=22.5 ms
64 bytes from 192.168.101.100: icmp_seq=3 ttl=64 time=22.2 ms
--- 192.168.101.100 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 22.245/23.221/24.925/1.208 ms
root@debiantesting:~# ping -c 3 192.168.101.56
PING 192.168.101.56 (192.168.101.56) 56(84) bytes of data.
64 bytes from 192.168.101.56: icmp_seq=1 ttl=63 time=20.6 ms
64 bytes from 192.168.101.56: icmp_seq=2 ttl=63 time=23.9 ms
64 bytes from 192.168.101.56: icmp_seq=3 ttl=63 time=21.1 ms
--- 192.168.101.56 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2004ms
rtt min/avg/max/mdev = 20.589/21.883/23.932/1.465 ms
root@debiantesting:~# ping -c 3 192.168.101.200
PING 192.168.101.200 (192.168.101.200) 56(84) bytes of data.
--- 192.168.101.200 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2056ms
traceroute from wireguard-client:root@debiantesting:~# traceroute -n 192.168.101.100
traceroute to 192.168.101.100 (192.168.101.100), 30 hops max, 60 byte packets
1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
24 * * *
25 * * *
26 * * *
27 * * *
28 * * *
29 * * *
30 * * *
root@debiantesting:~# traceroute -n 192.168.101.56
traceroute to 192.168.101.56 (192.168.101.56), 30 hops max, 60 byte packets
1 * * *
2 192.168.101.56 26.109 ms 26.078 ms 26.020 ms