Messages

If possible you should avoid Reverse NAT a.k.a. NAT Loopback anyway, so maybe a good moment to consider moving away from it ?!

Why? Genuine question.

IIRC that was a consideration when I set up openvpn prior to trying wireguard. It was a while ago and my memory is not great but I do remember deciding against using NAT reflection anywhere after reading the caveats in the docs. Preferring instead to use split DNS or in this case explicit port forwards.

I'm not aware of any drawbacks for this use, but choose whichever option is easier to implement for your use case.

You need to set up NAT reflection:

https://docs.opnsense.org/manual/how-tos/nat_reflection.html

Edit Peer:

Public key - you can use the one from the generator but just copy&paste it manually
Allowed IPs - 10.10.10.4/32 (peer address)

Endpoint Address - leave empty (set on the client/peer instance, not in OPNsense)
Endpoint port - leave empty (set on the client/peer instance, not in OPNsense)
Keepalive - leave empty (set on the client/peer instance, not in OPNsense)

Doing it manually is probably the best option.

Ps: Is Open VPN setup a less painful process? Any guides? I have a very simple setup as you have seen from the images, all I want is to have VPN access to the local network and connect to the internet as well once VPN is established.

I had no previous experience with WireGuard before setting it up in OPNsense and have managed to set up both S2S and Road Warrior links without much issue. It's not the most intuitive process in some cases, but it shouldn't be too much of a problem. You're probably 90% there and just missing some crucial step.

I would delete the current WG config and follow this guide: https://homenetworkguy.com/how-to/configure-wireguard-opnsense/

Please see attached. I am having trouble adding peer though using peer generator. Without presssing store text, it never saves (but it is already ticked). When I press, the keys change. When I finally save, endpoint info does not appear on the peer, which I need to add manually again. Not sure if these are known bugs for version 26.1.2

It's probably not a bug, the User Interface of the Peer generator is just plain terrible and counterintuitive.

When I am connected to the LAN and turn on wireguard, handshake is done however from outside there is no handshake.

Are you trying to connect to the WireGuard while the client is inside the local LAN or from an external network?

Have you tried lowering the MTU as meyergru suggested?

Disabling/reenabling WireGuard?

EDIT: meyergru is right, you have the source/destination reversed in the latest screenshot compared to your initial PDF.

You need to set up NAT reflection :
https://docs.opnsense.org/manual/how-tos/nat_reflection.html

Alternatively, you could use WG Tunnel and have it automatically disable the VPN while on selected WiFi:
https://github.com/wgtunnel/android

The only thing we have done is set it up to use a VPN.

Are connection problems while on VPN? What VPN? Same if it's disabled?

Possibly related to this?

Here's Grok's take. Can't verify if it works but it should get you started in the right direction.

I forgot mention that on the screeen from Proxmox -> pve -> Network , there is no setup any IP and gateway on the vmbr1 (VLANs_ETH0) - I setup IP and gateway for VLANs_ETH0 on the OPNsense and on WAN the same, so only is setup on the MAGMT_ETH1 setup 192.168.1.178/24.

This is confusing. You should only have IP and gateway on vmbr2 MAGMT (and not the same as LAN 192.168.1.1/24, as others have said), leave the other two blank.

It is also not clear how many DHCP servers you have on the network.

Is the TP Link SG108PE port towards Fujitsu S920 set up as trunk?

How are your interfaces set up in OPNsense?

Possibly related to #7148 and #6909?

For FQ_C bad performance or problems during slow/new start are usually caused by two reasons ECN & limit.

What is the final suggestion on ECN enable/disable? Resources, manuals, guides and forum posts are inconsistent regarding this. Some say to enable both for download and upload, some to disable it for upload. OPNsense guide isn't quite clear if it should be enabled or disabled for upload.

What does slow start refer to exactly and is there an easy way to test it?

Thank you!

Possibly related?

#7148
#6909

Hi, valid point and thanks for the advice, I can give it a try and based on the setup guide on quad9 its anyway not mentioned https://www.quad9.net/support/set-up-guides/setup-opnsense-and-dns-over-tls.

I've had issues with Quad9 DoT and DNSSEC, too. They explicitly say to disable it in their Pfsense guide:
https://docs.quad9.net/Setup_Guides/Open-Source_Routers/pfSense_%28Encrypted%29/

Not sure why it's not mentioned for Opnsense.