Messages

I got it working! I looked at the Firewall > Log Files > Live View and noticed that there was activity on my WireGuard interface, despite there being no devices connected to the WireGuard server at the time. I knew that there shouldn't be any activity, and maybe traffic was mistakenly trying to route through the WireGuard interface instead of the WAN interface. So I disabled the WireGuard interface and disabled the WireGuard server, and it worked!
I then removed all traces of WireGuard and carefully set it up from scratch. After that, it still worked, and I had my WireGuard VPN working. I'm not sure what setting was causing trouble, but I'm glad to have it figured out and I hope this is helpful to people who might run into something similar.

Hello OPNsense Community,

I'm experiencing an issue where clients connected to my WireGuard VPN server on OPNsense cannot access the internet. My setup involves:

Internet: Quantum Fiber, their provided modem/ONT is configured in transparent bridge mode.
OPNsense: Running the latest stable version. My WAN interface is receiving a DHCP address from the bridged modem.
LAN: Standard 192.168.1.0/24 network for local devices (which have full internet access).
WireGuard VPN: Server configured on OPNsense with the wg1 interface, using the 10.0.0.0/24 subnet for clients. The server's tunnel address is 10.0.0.1/24. "Disable routes auto-add" is unchecked.
VPN Client (Example): My laptop is configured with the address 10.0.0.3/32 and DNS server 192.168.1.1. Allowed IPs are 192.168.1.0/24, 10.0.0.0/24, 0.0.0.0/0. The VPN connection shows as active.
DNS: I have AdGuard Home running on OPNsense (192.168.1.1), listening on the standard DNS port. It is configured to forward queries to Unbound, also running on OPNsense (listening on port 53530). Unbound has Cloudflare (1.1.1.1, 1.0.0.1) and Google (8.8.8.8) DNS servers configured as forwarders. I have tried disabling DNSSEC and "Agressive NSEC" in Unbound. I have also tried setting the system DNS servers in OPNsense (System > Settings > General) directly to 1.1.1.1 and 1.0.0.1 with "Allow DNS server list to be overridden by DHCP/PPP/RADVD on WAN" unchecked.
Firewall Rules:
WG1: A "pass all" rule is in place for IPv4 from wg1 net to any destination.
LAN: Rules are in place to allow LAN clients internet access and to allow OPNsense to communicate with external DNS servers.
WAN: I have reviewed the WAN rules and do not see any explicit block rules for outbound traffic on ports 80 or 443 originating from my WAN IP.
Outbound NAT: A rule exists on the WAN interface with source 10.0.0.0/24, protocol "any", source port "any", destination "any", destination port "any", NAT address "Interface address".
Problem: While connected to the VPN, my laptop can resolve internal LAN addresses (e.g., ping 192.168.1.1) and DNS queries appear to be reaching OPNsense (based on AdGuard Home logs when system DNS was set to 192.168.1.1). However, I cannot access any websites (e.g., cloudflare.com). The browser indicates "address could not be found".

Troubleshooting Steps Taken:

Verified Quantum Fiber modem is in transparent bridge mode.
Rebooted both the modem and OPNsense.
Checked firewall rules on all interfaces multiple times.
Confirmed Outbound NAT rule for the VPN subnet is in place.
Tried different DNS configurations (Unbound forwarders, direct system DNS).
Disabled DNSSEC and Agressive NSEC in Unbound.
Verified WireGuard server and client configurations.
Used the Firewall Live View to monitor traffic. I see traffic from the VPN client (10.0.0.3) going to 192.168.1.1:53 (DNS), but I do not see any traffic originating from 10.0.0.3 with a destination of public IPs on ports 80 or 443. Interestingly, I did see traffic on the LAN interface with the VPN client as the source and a public IP as the destination, which seems incorrect.
I am at a loss as to why internet traffic from my VPN clients is not reaching the internet. Any insights or suggestions for further troubleshooting would be greatly appreciated.

Thank you in advance for your help! 1