Topics

I wanted to do a fresh install of Opnsense to change to ZFS filesystem and thought this would be a good opportunity so made a backup of my config file and installed 22.1. I then uploaded the config file and thought everything went smoothly until I noticed 1 of the 2 tunnels I have was not active. I have not been able to figure out the problem as I checked to make sure no spaces might have been in the secrets from the reinstall of the config. I even deleted the vpn configuration and reentered and still did not resolve the problem. I also deleted the wg0.conf file as I thought that might remove any trace of the configuration before recreating the tunnel. After spending many hours trying to figure this out finally reinstalled 21.7 and upgraded to 21.7.8. I then reinstalled the config and rebooted and both tunnels were now active. I then attempted to upgrade in place from 21.7.8 to 22.1 and after the upgrade only1 tunnel is active. It is the same tunnel wg0 that is not active. I did run wireguard restart from the command line and this is the output while running 22.1.

Code Select Expand

root@turnstone:~ # /usr/local/etc/rc.d/wireguard restart
wg-quick: `wg0' is not a WireGuard interface
[#] rm -f /var/run/wireguard/wg1.sock
[#] ifconfig wg create name wg0
[!] Missing WireGuard kernel support (ifconfig: SIOCIFCREATE2: Invalid argument). Falling back to slow userspace implementation.
[#] wireguard-go wg0
┌──────────────────────────────────────────────────────┐
│                                                                                                                          │
│   Running wireguard-go is not required because this                                       │
│   kernel has first class support for WireGuard. For                                           │
│   information on installing the kernel module,                                                   │
│   please visit:                                                                                                    │
│         https://www.wireguard.com/install/                                                         │
│                                                                                                                          │
└──────────────────────────────────────────────────────┘
[#] wg setconf wg0 /dev/stdin
[#] ifconfig wg0 inet 10.11.0.2/24 alias
[#] ifconfig wg0 mtu 1420
[#] ifconfig wg0 up
[#] route -q -n add -inet 10.11.0.2/32 -interface wg0
[#] rm -f /var/run/wireguard/wg0.sock
[#] ifconfig wg create name wg1
[!] Missing WireGuard kernel support (ifconfig: SIOCIFCREATE2: Invalid argument). Falling back to slow userspace implementation.
[#] wireguard-go wg1
┌──────────────────────────────────────────────────────┐
│                                                                                                                         │
│   Running wireguard-go is not required because this                                      │
│   kernel has first class support for WireGuard. For                                          │
│   information on installing the kernel module,                                                  │
│   please visit:                                                                                                   │
│         https://www.wireguard.com/install/                                                        │
│                                                                                                                          │
└──────────────────────────────────────────────────────┘
[#] wg setconf wg1 /dev/stdin
[#] ifconfig wg1 inet 10.11.3.2/24 alias
[#] ifconfig wg1 mtu 1420
[#] ifconfig wg1 up
[#] route -q -n add -inet 10.11.3.1/32 -interface wg1
[#] route -q -n add -inet 192.168.60.0/24 -interface wg1
[+] Backgrounding route monitor
ifconfig: interface wg0 does not exist


I see for wg0 at the bottom this statement rm -f /var/run/wireguard/wg0.sock so it is deleting wg0 where  normally should be my route to to an internal ip address of 192.168.0.0/24. I just don't know why it is breaking and the other VPN wg1 is working as the configurations are similar. When I look at the other Opnsense machine on the other side of the VPN it is showing the connection but no traffic is passing and the handshake time just keeps increasing until I restart the wireguard service.

I do have two other sites running Opnsense and upgraded to 22.1 without issue a couple weeks ago so I know it should work. I also noticed right before I'm posting this that the plugin for os-wireguard is showing misconfigured so don't know if that means anything as a couple other plugins also show misconfigured.  It is showing installed on the two other sites I have Opnsense running and all running os-wireguard 1.10. Also the hardware at all three sites is identical. 

I'm not going to be able to be on site at the location until next weekend but wanted to try and have some things ready to try to fix the problem and need to have this VPN active so any help to fix would be appreciated as I reinstalled 21.7.8 again to have he VPN's working.

I have a site to site Wireguard VPN setup and for the most part it functions without issue. The one issue I have noticed is when I'm at one site and try to access a device configuration settings via a browser at another site I get a timeout error and it will not connect. As an example I was trying to modify a configuration on a Yealink phone at the main site when I was at the remote site but got a connection timeout in the browser. However I could access a configuration on a Grandstream phone at the main site from the remote site. When at the main site I can access all the device configurations via browser. I can ping the device from the remote site to the main site and get a response with no packet loss so have connectivity. It's not a big deal but sometimes frustrating and just curious what might be preventing me from accessing some device configurations via the browser?

I have a working site to site VPN using OpenVPN and am considering switching to Wireguard however I cannot seem to get things to work correctly. I have tried to follow a couple setup guides and while I think I now have a connection between the sites as I have output in List Configuration and Handshakes I cannot seem to pass any traffic as I cannot ping anything on my home network. I have also seen a few posts recently where the latest version of Opnsense broke some Wireguard VPN's so not sure if that might be my issue.

I'm trying to go from my office with a static IP to my home with a dynamic IP.

Office Lan network is 192.168.0.1
Office Tunnel Address under Local for Wireguard is 192.168.100.1/24
Office Allowed IPs for Wireguard is 192.168.100.3/32

Home Lan network is 192.168.50.1
Home Tunnel Address under Local for Wireguard is 192.168.100.2/24
Office Allowed IPs for Wireguard is 192.168.100.3/32

Since I have a handshake between the two sites I'm thinking it might be a firewall issue so will attach screenshot of my firewall rules to see if I'm doing something incorrectly. I'm also a little confused about having to create a Wireguard interface. Some things I have read say you do not need to create it but if I don't create it I don't get the option under Rules in firewall for Wireguard. Therefore I have created rules for the interface WG and also for Wireguard so not sure if that is part of the problem.

Any assistance to get this figured out would be appreciated.