Messages

1

Intrusion Detection and Prevention / Re: Block connection to IPs which are not in DNS cache

« on: December 02, 2021, 02:06:52 pm »

This sounds like a problem for Zenarmor (sensei) to solve, not for opnsense. You should ask them if they can or have plans to do this.

2

Virtual private networks / Re: Wireguard-go multiple endpoints question

« on: December 01, 2021, 04:39:31 am »

No you only need one local config. You will need to check you are not missing steps when adding additional endpoints or misconfiguring.

3

21.7 Production Series / Re: Wireguard road warrior (followed default guide) - all work but cant ping clients

« on: November 30, 2021, 10:55:59 pm »

Its ios specific I believe. I have tested this at a nearby location that has the same lan range as my local lan network. Without this setup I cant access anything on the 192.168.2.0 range as it sends it local to the coffee shop. Adding in the additional range in allowed ips sends everything over the tunnel except the default gateway of the coffee shop which is 192.168.2.1. I can make a video from my phone on Saturday showing this working if you want as I can go past but not before then unfortunately.

4

21.7 Production Series / Re: Interfaces randomly go down/unroutable

« on: November 30, 2021, 10:44:11 pm »

Ninja in your case check arp table of oth the client you are pinging from and the arp table on opnsense during the issue. Hopefully you can attach a screen and keyboard to it while its happening. Check the arp table is good as the lan is not pingable this indicates a possible issue here.

5

21.7 Production Series / Re: Wireguard road warrior (followed default guide) - all work but cant ping clients

« on: November 30, 2021, 10:25:52 pm »

Actually one thing I noticed if I dont add the specific subnets is if I happen to go to a network (eg: coffee shop) that has the same range as my home (192.168.2.0/24 is common unfortunately) then I cant get back to my home network. The 0.0.0.0 is so all traffic is sent down the tunnel.

Luckily if you add the 2 routes they get a lower metric (higher priority) (eg adding 192.168.2.x and 192.168.200.x on the iphone allowed ips) and so long as the firewall or gateway at the coffee shop is not 192.168.2.2 (my opnsense firewall IP on the LAN) then I can still connect back home despite the network overlapping.

Thanks anyway for your help.

Pete

6

21.7 Production Series / Re: Wireguard road warrior (followed default guide) - all work but cant ping clients

« on: November 30, 2021, 10:08:51 pm »

Im really sorry I found my issue. I wish I could delete this post. I found a firewall rule that was blocking it that was created in a semi dynamic way. I have multiple vlans and had created a rule to prevent communication between vlans a while back and it was blocking the traffic. Once I saw this and added an allow rule above it for the WG network it started working fine. Sorry man I dont think I can delete threads but I would as its been a waste of time for you.

Hope its not a big deal.

Pete

7

21.7 Production Series / Re: Wireguard road warrior (followed default guide) - all work but cant ping clients

« on: November 30, 2021, 09:48:25 pm »

Sorry if I made the previous one too small. I can post again if need be.

Here is second.

8

21.7 Production Series / Re: Wireguard road warrior (followed default guide) - all work but cant ping clients

« on: November 30, 2021, 09:47:29 pm »

Most are on the road but I have my phone here:

The allowed ips are:
192.168.200.0/24, 192.168.2.0/24, 0.0.0.0/0

Have to do 1 ss at a time. I have one more to post after.

P

9

21.7 Production Series / Re: Wireguard road warrior (followed default guide) - all work but cant ping clients

« on: November 30, 2021, 09:20:41 pm »

For clarification:

192.168.2.0/24 - internal LAN

192.168.200.0/24 - Wireguard IP Range.

10

21.7 Production Series / Re: Wireguard road warrior (followed default guide) - all work but cant ping clients

« on: November 30, 2021, 09:19:02 pm »

From Opnsense no issue pinging the wg clients or itself. Also the WG clients can access anything and ping anything. I didnt bother getting a ss of that.

11

21.7 Production Series / Re: Wireguard road warrior (followed default guide) - all work but cant ping clients

« on: November 30, 2021, 09:16:33 pm »

And realize some rules are not needed - I was testing as it does not work.

12

21.7 Production Series / Re: Wireguard road warrior (followed default guide) - all work but cant ping clients

« on: November 30, 2021, 09:15:27 pm »

OK!

13

21.7 Production Series / Re: Unable to open specific website

« on: November 30, 2021, 05:56:03 pm »

Strange thing for me is that sometimes I can load the site and other times I cant so its like the site works sometimes. I noticed because on checking again after it worked first time I suddenly couldnt access it. now its working again.

14

21.7 Production Series / Re: Unable to open specific website

« on: November 30, 2021, 04:52:10 pm »

Maybe you use blocking like ids or something because works for me.

15

21.7 Production Series / Re: Wireguard road warrior (followed default guide) - all work but cant ping clients

« on: November 30, 2021, 02:12:46 pm »

Ok thank you for replying. Its appreciated you took the time to think about it.

With regards to my setup it is as follows. However at this exact moment its a little different as last night I did a load of testing (all made no difference) where I tired adding gateways, disabling automatic routes, adding manual routes, trying different things on outbound nat, removing interfaces adding interfaces etc. However seems like there is zero difference regardless what I do.

When you follow the opnsesne wireguard roadwarrior guide you end up with the auto generated wireguard interface and another one you make that if you look in interfaces - overview has the IP address you set under local- tunnel address.

So for example my LAN is 192.168.2.0/24 and the local tunnel address of WG interface is 192.168.200.1/24.

A client connects and is assigned an IP like 192.168.200.10/32 (ie by wireguard config).

So what is working? So basically everything important. The firewall itself can ping the 192.168.200.10 and the client on 192.168.200.10 can access any lan device and ping any lan device or the firewall on both 192.168.200.x range and 192.168.2.x range (so LAN and WG ranges work from the connecting roadwarrior side essentially).

However the LAN clients cant ping a wg ip. So for example if I am on a pc with 192.168.2.12 as its IP behind the firewall I cant ping 192.168.200.1 (the firewalls wg IP). I also cant ping 192.168.200.10 (A clients IP over the wg tunnel). I believe services cant be accessed either (eg I cant telnet to 192.168.100.10 on port 80).

So the traffic from LAN - a wireguard IP does not work. Im not sure if this is by design or not. Is it possible you are not allowed to try ping these IP's as they are exclusively for only clients on the WG tunnel? I assumed the firewall could or would know how to route a packet around its own interfaces to be able to reply to a ping but maybe I am wrong. I am using the kernel version of WG if that makes a difference. It could be I am expecting something that is not really designed to work.

P