Messages

I know this is a bit old, but did you ever get this sorted out?

I have been testing this kind of set up and found your post among my searches. I have some feedback that might help you or others searching the same sorts of issues.

I followed some processes from a YouTube video from channel What's New Andrew, titled "Sign in Always-On VPN with OPNsense & Mullvad: An Easy Step-by-Step Guide"
https://youtu.be/fFszlJpTBoc

He's using Mullvad in his example but it shouldn't make a difference.


I think the main difference, which it counter intuitive for me, is that he created the VPN Peer first, and then created the Instance from that.
This will probably solve your "offline" problem because it's your peer that is offline and the instructions you followed didn't document how to link them.

Another thing that may be documented that I missed, is to ensure to create an Outbound NAT rule for WireGuard(Group) to allow traffic. Then you can create your LAN rules for using the VPN instance you created.


These things got everything up and running and working overall.
My current issues are that I still get packet loss, around 13%-16% on average. Seems excessive to me.
     EDIT: I discovered I had a bad CAT6 cable causing the issues. Replaced it and I'm down to 3% packet loss (which still seems like it should be near 0 to me, but it isn't really a problem any longer)
I also get NAT Type 3 on my gaming consoles, despite having Proton's "Moderate NAT" setting on.
     EDIT: I am getting Type 3 on gaming consoled NOT running through the VPN as well, so it's something else in my network causing this. I also don't have any issue connecting with others...so it might be a false reporting or I do have some ports forwarded that might account for the non-issue. Regardless, it's not caused by the VPN so isn't a true problem to accompany this post.

You did post it in the wrong place (it's showing under Tutorials and FAQs).
I found it because I'm researching a similar scenario.

Maybe repost it under General Discussion and then delete this one.

Welcome to the forum. Are you able to share the setup of the VLANs and their rules? And do you have Unbound listening to "All interfaces (recommended)"?

Thanks for having me.


I was detailing out my answer to you which caused me to see what I overlooked a dozen times.

My LAN had IPv6 set to Track Interface. I set it to None and everything works as intended.


So even though you just asked questions, you helped me greatly. Thank you!

This is strange to me, so any help troubleshooting is appreciated.

My network consists of my ISP modem, into an opnsense box (latest firmware), which goes out wired via Netgear switches.
I have an AP (Grandstream 7665)connected via POE switch.

My main network is set to 192.168.10.1 and I have VLANs on subnets 20 (IoT), 30(Guest), and 40(Testing).

If I connect via a mobile phone to the main WiFi (10 subnet) the phone will connect immediately but state it has no internet for approximately 20 seconds.  I have tested this with multiple devices to rule out the device themselves.

If I connect to any of the VLANs, it will connect immediately and also immediately have internet access.

I've tested variances with the SSIDs, such as WPA2 vs 3, Tri-Band vs 2.4 & 5Ghz, client isolation on/off, etc. 
None of the settings impact the connection other than whether I'm connecting to the main 10 subnet. Which makes me think it's an OPNsense setting.

"Not having internet" sounds like a DNS issue to me, but I have the same Unbound DNS rules applied to each interface so I'm not sure why it performs differently.

What am I missing?
Thanks in advance.