outbound NAT misses 10.0.0.0/24 when assigned wg interface has no IPv4 config
Hi everyone,
I just spent a few hours troubleshooting a subtle issue with the WireGuard plugin, and since the fix was not documented anywhere I could find, here is a full write-up. Hopefully it saves someone else the debugging time.
Setup
Proxmox host behind an ISP box (double NAT). OPNsense runs as a VM on the Proxmox host and serves several VLANs (LAN, Wi-Fi, cameras...). The WireGuard plugin (os-wireguard) terminates a full-tunnel VPN for road-warrior clients, subnet 10.0.0.0/24 , outbound NAT in hybrid mode.
Symptom
WireGuard tunnel works fine for reaching the LAN: clients connect, they can reach hosts behind OPNsense (Home Assistant, Proxmox, etc.). But with a full-tunnel client ( 0.0.0.0/0 ), IPv4 internet through the tunnel silently fails — while some websites appear to work.
On my Linux client:
$ curl -4 -v --connect-timeout 10 https://www.google.com
* Trying 142.251.157.119:443...
* Connection timed out after 10001 millisecondsThe confusing part: Google, Amazon and other big sites loaded fine — because my ISP line has IPv6, and WireGuard's 0.0.0.0/0 only captures IPv4. IPv6 traffic bypassed the tunnel entirely, making half the internet look healthy. Any IPv4-only site failed.
DNS was fine, and OPNsense itself could ping 8.8.8.8, so the WAN path was healthy.
Diagnosis
The live firewall log showed the smoking gun: packets from the WireGuard client were leaving the WAN interface with their original source address, never NATed:
WAN out TCP 10.0.0.2:59398 -> 54.171.207.179:443 pass (let out anything from
firewall host itself)
WAN out UDP 10.0.0.2:33065 -> 141.101.90.106:443 pass
The ISP box in front of OPNsense obviously can't route replies back to 10.0.0.2, so every connection times out.
Root cause
The WireGuard interface is assigned (Interfaces → Assignments, device wg0 ), but its IPv4 configuration type
is "none" — which is normal with the os-wireguard plugin, since the plugin itself manages the address on
wg0 .
However, automatic outbound NAT builds its "local networks" list from the addresses configured on assigned interfaces. With IPv4 set to "none", the WireGuard subnet ( 10.0.0.0/24 in my case) never makes it into the automatic outbound NAT rules — so client traffic egressing WAN is never translated.
You can confirm by looking at Firewall → NAT → Outbound (hybrid/automatic mode): the auto rule sources list "LAN networks, VPN networks, ..." but the VPN interface contributes nothing since it has no configured address.
Fix
Add a manual outbound NAT rule (Firewall → NAT → Outbound → Add):
Setting Value
Interface WAN
Protocol any
Source 10.0.0.0/24 (or your WireGuard alias)
Source port *
Destination *
Destination port *
Translation address Interface address
|
Apply, reconnect the client, done:
$ curl -4 -sI https://www.google.com
HTTP/2 200Note: I deliberately did not set a static IPv4 on the assigned wg interface, since the plugin already manages the address on wg0 and I did not want to risk a duplicate address.
Suggestion
It would be great if the os-wireguard plugin (or the outbound NAT page) could warn the user when an assigned wg interface has no IPv4 configuration, hinting that automatic outbound NAT will not cover its subnet. Maybe a docs note would be enough. Happy to file this on GitHub if it's the right place