Messages

Hi. I need guidance on how to tshoot wireguard configuration and find where the configuration error is. I'm trying to set up a wireguard VPN with the OPNSense firewall as client (initiating) to a public VPN service. When I activate it, the client traffic does not go through and I cannot get any traffic from a laptop to anything outside the local network. I've been going though instruction for days now, but unfortunately there is little information on how to confirm what you have done is correct. I'm missing a "do this and that, and then it should look like this"-guide. I've been following mostly this guide: https://docs.opnsense.org/manual/how-tos/wireguard-selective-routing.html

First off: Is this the right order of operations for traffic flow in OPNSense?
1- Firewall rules on incoming interface
2- Wireguard tunneling
3- Routing
4- NAT (In my case Hybrid)
5- Zenarmor (configured in passive mode currently)

Looking though logs, I can only find a trace of traffic flow for step one above. It seems to hit the right firewall rule, with the wireguard peer as the gateway. But after that I can't really confirm anything nor find any traces in logs - but I'm not sure where to look either.

2- WG tshooting:
The wireguard service is running and wireguard status shows two rows in the table:

Instance: Status Up. Port/endpoint only has a port number. Handshake, Send, Received are all empty.
Peer: No status, Port/Endpoint, Handshake, Send, Received all have values.
Not sure what values to expect in this table.

Firewall -> Diagnostics -> Statistics, interface wg0 shows a bunch of packets passed out, nothing coming back and almost all counters are zero.

3 - Routing tshoot
I have a route configured (floating) and that has logging switched on, but i can't find a trace if log confirming this route is actually used.


Feels like WG config is wrong but I can't figure it out. Any ideas? Preferably on how to verify WG tunnel config.

OPNSense OPNsense 24.1.10_2-amd64

Alternatively I tried running only on the LAN. This also has the benefit of potentially looking at any dodgy stuff internal to the network. But when I tried it (even in promiscuous mode() I could only see traffic that was going to/from the router & not other lan traffic

That sounds right to me. The switches will only forward traffic to the firewall LAN interface if the MAC address in the ethernet header is that of the Firewall LAN interface. That will happen when each client inside your network decides to use the gateway as next L2 hop. Inspecting on LAN interface is probably what you want, You'll catch your clients trying to connect to dodgy hosts on the internet, and you can identify those internal clients by IP address and/or MAC address.

Getting horizontal network traffic is not easy. I know of two ways:
- Buy Cisco 9000 series switches or similar and StealthWatch or whatever they call it now.
- Configure span ports on switches that dump all traffic to a separate interface on the firewall. If you have dumb switches that is not an option, and besides it is a really ugly solution that might work for a small network only.

Regarding your other questions I have no idea.

Is there a way to get Zenarmor statistics into telegraf input? I'm experimenting with dashboards for OPNSense, I've got data from system, cpu, net, pf etc in there already. At this point I'm not really sure what to google for or how this even works. Do I need output to local log, how can I verify that etc.

I'm using the free version of zenarmor atm, but I don't mind paying for the home version.

It's a cosmetic glitch in 23.7.9 that has been fixed on newer version.
See this https://forum.opnsense.org/index.php?topic=37420.0

Though so. Could not find anything when I search for this, maybe my search skills are declining.

Thanks.

Hi,

I have a bunch of auto-generated rules on the WAN interface, a typical auto-generated usually-what-you-whant kind of thing. They are all fine, but since I have checked the "block private networks" checked it created a rule to block traffic from private subnets. It looks like this:

10.0.0.0/8, 27.0.0.0/8, 00.64.0.0/10, 72.16.0.0/12, 92.168.0.0/16

Except the first one they are all wrong. Is this because of something I did or did someone mess this up in the code somewhere? Thee digits are allowed in the first octet...  ;)

Running OPNsense 23.7.9-amd64