I have an issue where I've established people can connect to my Twingate connector and connect to my endpoint resources where I can authenticate to the remote connector, but cannot connect to their endpoints through Opnsense. If I bypass Twingate completely, I can authenticate to the remote Twingate connector and connect to their endpoints. When connected through Opnsense, I cannot ping or establish remote connections (ssh, rdp, ftps, etc...). Originally, I would see the FW logs blocking outbound for the allowed TCP ports below. After creating an allow outbound rule, the traffic is successfully going out but I'm still having issues connecting to the remote clients through Twingate. Appreciate any insights. Thanks.
Block rules implemented
Block Private Ranges
10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16
Crowdsec_blocklists for the most common 3 block list for known threats
GeoBlocking from Maxmind
Allowed outbound for ports TCP 30000-31000
Exclusion for subnets on my network and the remote network.
After some investigating, turns out my Crowdsec rule was blocking the outbound connection to the remote Twingate relay connector. Even though I could authenticate to the service, the block rule would deny the connection to remote relay through one or more of it's intermediary host servers even though I allowed the require outbound ports. I believe the intermediary servers establishes the initial handshake before a direct P2P connection is later established for the session.