Messages

[Ensure that there is no pass rule in the Wireguard applied to the forwarded traffic from A!]

Hi,

thanks for the help!

At site B assign an explicit interface to the Wireguard instance (wgX).

Then move over all rules from Wireguard (group) to the new interface.

Ensure that there is no pass rule in the Wireguard applied to the forwarded traffic from A!

Can you elaborate a bit why that will help?

The port forwarding should happen on "OPNsense A", which already has access to all needed ports of the services behind "OPNsense B". Why do I need to change settings on "OPNsense B"?

In the meantime I learned that Caddy has a "Layer 4 proxy" feature which is able to serve my needs -- I was able to proxy SSH and will test later with IMAP and SMTP. Still wondering why port forwarding fails.


PS: to whoom it may concern: thanks a lot to the great work done with OPNsense, didn't expect to be able to migrate this fast from my simple DSL router to FTH with this setup.

Hi,

I fail to configure a Port Forwarding through a Wireguard tunnel properly...

My Setup:

* OPNSense A with a Public IP as WAN (and no LAN)
* OPNSense B behind a FTH Modem with changing IP (WAN with DHCP) and a LAN (192.186.1.0/24)
* Wireguard is configured following the "Wireguard Side to Side" example in the Documentation: https://docs.opnsense.org/manual/how-tos/wireguard-s2s.html#
* OPNSense A has the Caddy Package installed and does Reverse Proxy for two web servers hosted in the 192.168.1.0/24 network, for example for 192.168.1.10
* being on the command line of OPNSense A I can connect to 192.168.1.10 using SSH

I want to do port forwarding for IMAP/SMTP and started testing with SSH, where a Port on the WAN interface of OPNSense is forwarded to a machine in the LAN of OPNSense B, for example

OPNSense A:8022 -> 192.168.1.10:22

I can see a match for this rule in the firewall logs, but Port 8022 is listed as "filtered" in an nmap scan and SSH connections don't work.

If I add a Port Forwarding to the Firewall itself it works (OPNSense A:8022 -> OPNSense A:22).

I activated "Reflection for port forwards" and "Automatic outbound NAT for Reflection" as suggested in some posts.

Both OPNSense are the latest stable (Version 24.7.11_2) so I assume older threads talking about problems with the non-kernel implementation of Wireguard do not Apply.

Any Idea where the problem is?