1
Virtual private networks / Re: Wireguard port - public wifi
« on: Today at 03:20:39 pm »
No, you need a fw rule. But why not a rule to port 465, with WG listening on that port instead of 989?
Show Posts
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
2
Virtual private networks / Re: Wireguard port - public wifi
« on: Today at 01:42:57 pm »
Why not just have WG listen on 465 and forget about port forwarding?
3
21.7 Production Series / Re: Alias not being processed correctly in NAT and/or Firewall rules?
« on: Today at 02:47:32 am »
Have you applied the alias? Check under Diagnostics/Aliases to confirm the entries are there.
I have no issues using port aliases in port forwards, even where the ports are not contiguous.
I have no issues using port aliases in port forwards, even where the ports are not contiguous.
4
Hardware and Performance / Re: Massive performance problems floating rules vs interface rules
« on: September 20, 2021, 01:09:17 pm »
Lol. He was just referring to iperf
5
Virtual private networks / Re: [SOLVED] Wireguard selective routing
« on: September 19, 2021, 10:13:27 pm »
Haven’t tried, but maybe you are hitting the reply-to issue for which there is a solution here
6
Virtual private networks / [SOLVED] Wireguard selective routing
« on: September 19, 2021, 01:23:58 am »
@x390, nvm, it seems the tool I was using for IPv6 traceroute was broken, as it didn’t work regardless of whether the client was using the tunnel or not. I will test another tool later but expect it will be OK (Edit: Yes it is OK)
7
Virtual private networks / Re: [SOLVED] Wireguard selective routing
« on: September 18, 2021, 10:15:00 pm »
Thanks. I tried it just now from OPNsense and that gave me the Mullvad tunnel IP (same as yours). So now I have my monitor IP. 
Did you test though on a client behind OPNsense that is using the tunnel?
BTW, the behaviour you noticed of the traceroute always going via the tunnel may have been because you had Cloudflare as your monitor IP? OPNsense creates a static route for the monitor IP which means traffic to that IP will always be sent down the tunnel.
Did you test though on a client behind OPNsense that is using the tunnel?
BTW, the behaviour you noticed of the traceroute always going via the tunnel may have been because you had Cloudflare as your monitor IP? OPNsense creates a static route for the monitor IP which means traffic to that IP will always be sent down the tunnel.
8
General Discussion / Re: How To Add An Access Point, And Assign SSIDs To Interfaces?
« on: September 18, 2021, 07:00:09 am »
IMO you need VLANs and a managed switch to achieve what you need.
So eg:
- LAN on ix2 on OPNsense (configured as direct interface on physical NIC, and so will be treated as native/untagged, ie effectively VLAN 1)
- VLAN 10 (eg) for LAN2 on ix1
- VLAN 20 (eg) for Guest on ix1
- no direct interface on ix1
- ix1 and ix2 connected to managed switch ports. Switch port that ix1 connects to configured for VLAN 10 and 20, and switch port that ix2 connects to configured for VLAN 1
- third switch port connected to AP, and configured to be a trunk port (ie so that it accepts traffic for all VLAN tags)
- SSIDs configured on AP to match VLAN tags as required
- configured fw rules on OPNsense to manage traffic between LAN, LAN2 and Guest as required
Who do you need 2 SSIDs for each of LAN and LAN2? Are these just for separate 2.4Ghz and 5GHz frequencies, but same subnet?
So eg:
- LAN on ix2 on OPNsense (configured as direct interface on physical NIC, and so will be treated as native/untagged, ie effectively VLAN 1)
- VLAN 10 (eg) for LAN2 on ix1
- VLAN 20 (eg) for Guest on ix1
- no direct interface on ix1
- ix1 and ix2 connected to managed switch ports. Switch port that ix1 connects to configured for VLAN 10 and 20, and switch port that ix2 connects to configured for VLAN 1
- third switch port connected to AP, and configured to be a trunk port (ie so that it accepts traffic for all VLAN tags)
- SSIDs configured on AP to match VLAN tags as required
- configured fw rules on OPNsense to manage traffic between LAN, LAN2 and Guest as required
Who do you need 2 SSIDs for each of LAN and LAN2? Are these just for separate 2.4Ghz and 5GHz frequencies, but same subnet?
9
Virtual private networks / Re: Opnsense with Mullvad NOT WORKING
« on: September 18, 2021, 04:12:03 am »
No problem. I’ve submitted a PR for the docs to be updated: https://github.com/opnsense/docs/pull/349
10
Virtual private networks / [SOLVED] Wireguard selective routing
« on: September 18, 2021, 01:55:27 am »
@x390, I did my own testing and agree it seems to work.
One odd thing though is that IPv6 traceroutes from a client using the tunnel times out. Is that your experience? Ping works, browsing works, just not traceroute.
I use traceroute to find out the tunnel IP at Mullvad so I can use that as the monitor IP for the gateway. Works fine for IPv4.
BTW, OPNsense didn’t like it if I removed the IPv4 gateway from the Local config.
One odd thing though is that IPv6 traceroutes from a client using the tunnel times out. Is that your experience? Ping works, browsing works, just not traceroute.
I use traceroute to find out the tunnel IP at Mullvad so I can use that as the monitor IP for the gateway. Works fine for IPv4.
BTW, OPNsense didn’t like it if I removed the IPv4 gateway from the Local config.
11
Virtual private networks / Re: [SOLVED] Wireguard selective routing
« on: September 17, 2021, 12:41:39 pm »
Ha, good to know! Perhaps there is no need to specify a gateway in the Local config at all…
I think I will update the how-to so that it has the IPv6 details.
I think I will update the how-to so that it has the IPv6 details.
12
Virtual private networks / Re: [SOLVED] Wireguard selective routing
« on: September 17, 2021, 11:50:18 am »
Good question. I asked the same a while back but haven’t received any feedback: https://github.com/opnsense/core/issues/5066.
However, I did manage to figure out how to create an IPv6 gateway, as indicated in that thread. I took the IPv6 tunnel IP given to me by my VPN provider (Mullvad), and included that as an additional Tunnel Address in the Local config. But rather than a /128, I specified it as a /127.
Then I allocated another address within that /127 as the gateway address, which worked.
I just didn’t get around to testing whether, once appropriate firewall rules and outbound NAT rules were created (like the equivalent IPv4 rules, but using the IPv6 gateway in the firewall rules), that would be enough. It is possible that, because Disable Routes is selected in the WG Local config, policy based routing established by the firewall rules is enough to get it working.
If I get some time, I will try to complete the config and testing. If you manage to try it out, let me know the results!
However, I did manage to figure out how to create an IPv6 gateway, as indicated in that thread. I took the IPv6 tunnel IP given to me by my VPN provider (Mullvad), and included that as an additional Tunnel Address in the Local config. But rather than a /128, I specified it as a /127.
Then I allocated another address within that /127 as the gateway address, which worked.
I just didn’t get around to testing whether, once appropriate firewall rules and outbound NAT rules were created (like the equivalent IPv4 rules, but using the IPv6 gateway in the firewall rules), that would be enough. It is possible that, because Disable Routes is selected in the WG Local config, policy based routing established by the firewall rules is enough to get it working.
If I get some time, I will try to complete the config and testing. If you manage to try it out, let me know the results!
13
21.7 Production Series / Re: Setting a firewall option without passing or rejecting traffic
« on: September 17, 2021, 03:01:15 am »
OP - just a thought. If you configure the IPv4 upstream gateway for the relevant interface under the interface settings, does that achieve the outcome for you?
14
21.7 Production Series / Re: Setting a firewall option without passing or rejecting traffic
« on: September 17, 2021, 02:16:54 am »
Don’t see how that solves the issue? Only one of the rules will apply
15
21.7 Production Series / Re: Setting a firewall option without passing or rejecting traffic
« on: September 17, 2021, 01:26:47 am »
AFAIK you can’t specify simply a “Match” action for a rule.
Can’t you just set the reply-to field on all the other rules?
Can’t you just set the reply-to field on all the other rules?