OPNsense Forum

English Forums => 25.1, 25.4 Production Series => Topic started by: slicedbread on March 06, 2025, 06:00:54 PM

Title: wireguard vpn only allows the latest peer to connect
Post by: slicedbread on March 06, 2025, 06:00:54 PM
I followed the official road warrior setup guide for wireguard, and it worked perfectly with my first peer. However, as soon as I generate another peer in the gui, my original peer cannot make any connections. As soon as the second peer is disabled, the original peer can once again ping addresses both inside and outside my lan. I have been troubleshooting this for a few days now so any help is appreciated, and sorry if I am asking in the wrong place. firewall rules below.


on the wan interface:
action: pass
interface: wan
direction: in
tcp/ip version: ipv4
protocol: udp
source: any
desitination: wan address
port: 51820

on the wireguard interface:
action: pass
interface: wireguard
direction: in
tcp/ip version: ipv4
protocol: any
source: wireguard net
desitination: any


peer 1 configuration:

[Interface]
PrivateKey = abc...
Address = 10.10.90.2/24
DNS = 10.10.90.1

[Peer]
PublicKey = abc...
PresharedKey = abc...
Endpoint = vpn.mydomain.com:51820
AllowedIPs = 0.0.0.0/0,::/0


peer 2 configuration:

[Interface]
PrivateKey = abc...
Address = 10.10.90.3/24
DNS = 10.10.90.1

[Peer]
PublicKey = abc...
PresharedKey = abc...
Endpoint = vpn.mydomain.com:51820
AllowedIPs = 0.0.0.0/0,::/0



Title: Re: wireguard vpn only allows the latest peer to connect
Post by: Ngr on March 06, 2025, 06:46:08 PM
Shouldn't the peer addresses be /32 rather than /24?
Title: Re: wireguard vpn only allows the latest peer to connect
Post by: dirtyfreebooter on March 07, 2025, 12:43:48 AM
Quote from: Ngr on March 06, 2025, 06:46:08 PMShouldn't the peer addresses be /32 rather than /24?

yea the /24 on the peer is likely clobbering the entire subnet