Messages

thats make sense Patrick.

thank you for your explanation,you have solve my problem.

i want to connect from the wireguard instead of the vlan  client to have an extra layer of security.

ok i see, maybe my falt

i need to create an alias for the  client defined in the wireguard vpn peers (ip) instead of the vlan client linux_pc

then i create a rule for wireguard  that allow from source wireguard peer(linux_pc1) destination this firewall

is that will work

i place that rule on vlan network, but on the wireguard rule i need to include also??

if i dont while im connect from the linux_pc vlan with wireguard client i loose connection

or better what rule should i put on wireguard to allow access from linux_pc that use a wireguard client

vlan linux---->linux_pc------->wireguard client linux pc

the linux_pc is the ip address of a machine inside a vlan that connect to the wireguard client

it only work if i set the wireguard firewall rule as

source wireguard net and destination this firewall

which mean the all wireguard vpn have access

when i change the firewall wireguard rule to
source linux_pc and destination this firewall i loose connection with the web gui.

hello Patrick
i have a similar issue with restricting the Gui web access only to a specific client of wireguard
i have create an alias for the machine with a specific ip address
i set listen interface to all

from wireguard theclient allowed ip is  0.0.0.0/0,::/0

from firewall rule i set a rule with allow the source  wireguard net to destination This firewall.


now if i want to limit the access to the firewall to a specific wireguard client i create a nat port forward rule as you suggested.

Firewall: NAT: Port Forward


Interface   Proto         Address                 Ports           Address           Ports                IP                Ports

wireguard   TCP/UDP    Linux_PC       443 (HTTPS)   This Firewall   443(HTTPS)      127.0.0.1         443 (HTTPS)   

is that will work?

thanks i found it.
i found a strange rule set to the floating rule allow anything from anywhere.
i delete this rule now my vlan are isolated.

Thanks for the support Guys

hi viragomann

how i  flush the states in opnsense

Hello All

my setup
Opnsense act as gateway
switch usw lite 8 poe
two unifi u6 pro wireless ap
From opnsense have setup a bunch of Vlan parent with my lan network
i have created the interfaces, dhcp server and firewall rules for every single Vlan.

on the firewall rules i have the rule which block the connection to internal private ip.So i should be isolated from the rest of my network.
That is strange because i can ping any other vlans and the firewall


this is something that i need to modify from the switch side? or i need to buy a unify switch that support the ACl capability.

Im confuse.

Anybody encore in this scenario.

please help

I resolve it adding a static route for each wireguards  VPN istances.from System -> Routes -> Contiguration then add my subnet

Thanks luckylinux

I hade the same problem creating multiple istances in Wireguard with no connection.

I hade connection only on one istance.

I resolve it adding a static route for each wireguards  VPN istances.from System -> Routes -> Contiguration then add my subnet

Best effort Mate.

You solve the issue.

Regards

Hello All

i have manged to setup wireguard instance with peers on my opnsense 25.1.9 which works on my local network with No access from the outside.(no rules for WAN).I did not include a new gateway, I follow the guide road warrior.

Everything works. i have connection and handshake.

Now i want to create new instances (wg1,wg2,wg3..)to fit in every Vlans.This because i like  to assign  different firewall rules in base on Vlans.

I recreate the same procedure as my first istance (new interface, new firewall rule, new istance, new peer) but i have no connection.I tested with tcpdump

Im stuck .What do i need to incorporate to my new interfaceI have tried to check the option in the interface "Dynamic gateway policy" to create a different  gateway but that want not work.

client do not comunicate with the wireguard server

Which log do I need to provide ?

Any help please..

Thanks

I got the rule fixed. Thanks Bob.Dig
you helped me fixed this

my VLAN10 rule was wrong

What is your rule fixed