Messages

You could have posted at least a screenshot of the supposedly messed up rules after migration.

"It doesn't work" is not very helpful.

I have 4 GB of RAM in the system. The system is running at 30% capacity.
When unbound crashing it occurs after the DNS blocklist is updated,
which is done via cron once a day.
However, unbound does not crash every day after the cron job runs.

4 GB is not enough for newer versions with larger blocklists. It doesn't consume much while running, but dynamically it can shoot up rather high, especially for Unbound using blocklists. Try disabling them and see if the crashing changes.

Unbound temporarily consumes a lot of RAM when rebuilding Blocklists, maybe even more in recent versions. How much RAM do you have?

If possible you should avoid Reverse NAT a.k.a. NAT Loopback anyway, so maybe a good moment to consider moving away from it ?!

Why? Genuine question.

IIRC that was a consideration when I set up openvpn prior to trying wireguard. It was a while ago and my memory is not great but I do remember deciding against using NAT reflection anywhere after reading the caveats in the docs. Preferring instead to use split DNS or in this case explicit port forwards.

I'm not aware of any drawbacks for this use, but choose whichever option is easier to implement for your use case.

You need to set up NAT reflection:

https://docs.opnsense.org/manual/how-tos/nat_reflection.html

Edit Peer:

Public key - you can use the one from the generator but just copy&paste it manually
Allowed IPs - 10.10.10.4/32 (peer address)

Endpoint Address - leave empty (set on the client/peer instance, not in OPNsense)
Endpoint port - leave empty (set on the client/peer instance, not in OPNsense)
Keepalive - leave empty (set on the client/peer instance, not in OPNsense)

Doing it manually is probably the best option.

Ps: Is Open VPN setup a less painful process? Any guides? I have a very simple setup as you have seen from the images, all I want is to have VPN access to the local network and connect to the internet as well once VPN is established.

I had no previous experience with WireGuard before setting it up in OPNsense and have managed to set up both S2S and Road Warrior links without much issue. It's not the most intuitive process in some cases, but it shouldn't be too much of a problem. You're probably 90% there and just missing some crucial step.

I would delete the current WG config and follow this guide: https://homenetworkguy.com/how-to/configure-wireguard-opnsense/

Please see attached. I am having trouble adding peer though using peer generator. Without presssing store text, it never saves (but it is already ticked). When I press, the keys change. When I finally save, endpoint info does not appear on the peer, which I need to add manually again. Not sure if these are known bugs for version 26.1.2

It's probably not a bug, the User Interface of the Peer generator is just plain terrible and counterintuitive.

When I am connected to the LAN and turn on wireguard, handshake is done however from outside there is no handshake.

Are you trying to connect to the WireGuard while the client is inside the local LAN or from an external network?

Have you tried lowering the MTU as meyergru suggested?

Disabling/reenabling WireGuard?

EDIT: meyergru is right, you have the source/destination reversed in the latest screenshot compared to your initial PDF.

You need to set up NAT reflection :
https://docs.opnsense.org/manual/how-tos/nat_reflection.html

Alternatively, you could use WG Tunnel and have it automatically disable the VPN while on selected WiFi:
https://github.com/wgtunnel/android

The only thing we have done is set it up to use a VPN.

Are connection problems while on VPN? What VPN? Same if it's disabled?

Possibly related to this?

Here's Grok's take. Can't verify if it works but it should get you started in the right direction.

I forgot mention that on the screeen from Proxmox -> pve -> Network , there is no setup any IP and gateway on the vmbr1 (VLANs_ETH0) - I setup IP and gateway for VLANs_ETH0 on the OPNsense and on WAN the same, so only is setup on the MAGMT_ETH1 setup 192.168.1.178/24.

This is confusing. You should only have IP and gateway on vmbr2 MAGMT (and not the same as LAN 192.168.1.1/24, as others have said), leave the other two blank.

It is also not clear how many DHCP servers you have on the network.

Is the TP Link SG108PE port towards Fujitsu S920 set up as trunk?

How are your interfaces set up in OPNsense?

Possibly related to #7148 and #6909?