Hey guys,
I set up ProtonVPN following this guide: https://forum.opnsense.org/index.php?topic=38550.0
Everything worked pretty well until I recently tried adding a second instance of ProtonVPN (with a new config).
ProtonVPN's documentation says you can run multiple WireGuard instances at the same time by incrementing the IP at a certain point: https://protonvpn.com/support/wireguard-configurations
So for example, instead of 10.2.0.1, you can use 10.3.0.1 for the gateway and DNS.
I spent quite a while debugging why the second instance wasn't working, until I noticed that traffic to 10.3.0.1 was going out over my default gateway instead of the WireGuard tunnel, because the route was missing.
Once I added the route manually, everything worked for a few minutes, including my gateway monitoring. But after a while it stopped working again, and I can't figure out why.
Any help would be really appreciated, or even just hearing about other people's experiences with this.
Just to clarify: the first instance has never had any issues, while for the second one I'm using the gateway/DNS address (10.3.0.1) as the monitoring target.
I did everything again from the guide, just for the second instance, so the settings should not overlap.
The Wireguard handshake also does not appear to be the source of the problem
Make the Tunnel address 10.3.0.2/30.
The tunnel IP for the first instance, 10.2.0.1/32, did set the route properly until I disabled the static routes.
I changed the tunnel IP from 10.3.0.1/32 to /30 .
I'm a bit confused: the routes now look correct, and everything works when I set both the first and second instances to a /30 subnet.
For some reason, only a single WireGuard instance at a time sets an additional route to the gateway/DNS address. Right now it's 10.3.0.1; before, it was 10.2.0.1. I am not using any manual routes right now.
My routes now look like this:
10.2.0.0/30 link#14 U wg0
10.2.0.2 link#3 UHS lo0
10.3.0.0/30 link#15 U wg1
10.3.0.1 link#15 UHS wg1
10.3.0.2 link#3 UHS lo0
Can I leave them like this? also I have issues with an additional third ipv6 wg so I should also just change this 2a07:b944::2:2/128 to /126?
Quote from: Unsocial_Firewall on <strong>Today</strong> at 10:23:01 PMat a time sets an additional route to the gateway/DNS address.
Monitor IPs get a route added automatically.
Quote from: Unsocial_Firewall on <strong>Today</strong> at 10:23:01 PMCan I leave them like this?
Sure, why not if it is working.
Quote from: Unsocial_Firewall on <strong>Today</strong> at 10:23:01 PMso I should also just change this 2a07:b944::2:2/128 to /126?
Never done it myself (IPv6 VPN) but it is looking good to me.
Thanks a lot! Yup, everything seems to work for now, and I'll do some more testing.
QuoteSure, why not, if it is working.
Well, I barely know anything about WireGuard, so I don't know all the ramifications of changing the provided subnet from ProtonVPN from /32 to /30.
The ipv6 works now aswell but there still is no static route for 10.2.0.1... (Even though it's the monitor ip)