No internet on LAN computers after WireGuard setup

[roninxt]

I followed this to setup WireGuard: https://docs.opnsense.org/manual/how-tos/wireguard-client.html
It's working fine when I connected my phone as a client and I can access my network, my phone also has internet.

Other computers (non WireGuard clients) that are connected to LAN unfortunately don't have internet access. I have to disable Wireguard VPN to bring back the internet connection. It looks like a DNS resolution issue as indicated in my browser. Unbound by default is listening to all outgoing interfaces so this shouldn't be a problem? Btw, I also use DNSCrypt-Proxy so Unbound serves as a forwarder. Any idea on how to solve this?

[Greelan]

Is the VPN subnet different to the LAN subnet?

[roninxt]

Yeah the VPN subnet is 10.0.0.1/24 while LAN is 192.168.0.1/24

[Greelan]

You probably need to share your configs in order to troubleshoot

[chemlud]

In the wg server config don't enter a DNS server and restart wg.

[Greelan]

I was thinking the same thing, given the wg-tools habit of overwriting resolv.conf. Although if the DNS server was set to the local unbound server it should have still worked

[roninxt]

In the wg server config don't enter a DNS server and restart wg.

This didn't fix the issue.

It looks like it's the server instance that's causing this. I enabled WireGuard but disabled the server instance, it didn't affect the LAN internet. When I enabled the server instance that's when the issue happens.

The server instance setup is standard:
Local

Code Select Expand

Listen Port: 51820
DNS Server: 192.168.30.1
Tunnel Address: 10.11.0.1/24
Peers: <see Endpoint below>

Endpoint

Code Select Expand


Allowed IPs: 0.0.0.0, 10.11.0.2/32


Again, I have Unbound setup with DNSCrypt-Proxy.

[Greelan]

Remove 0.0.0.0 from the endpoint config on OPNsense

[roninxt]

I removed the 0.0.0.0 from the Endpoint.

I finally know what's the problem. It's my WG0 interface. For some reason it was using igb0 which is the WAN interface. I'm using PPPoE so there was another interface created igb0 pppoe which is used by WAN. What's weird is there's no wg0:000:000 assignment to choose from the dropdown. So I deleted the WG0 interface, reinstalled WireGuard and enabled it and did the setup properly again. This time wg0:000:000 can be selected.