Wireguard interface active, but Zenarmor not filtering/reporting data.

[wirefall]

Thanks a lot for your work, much appreciated! 

[JasMan]

Any news regarding this issue? I also have the same here, no wireguard traffic in Zenarmour, engine stops with same alert "Cannot validate interface:..." so I always have to restart...

Opnsense 23.7.3
os-wireguard 2.0_2
os-sensei 1.14.5

Thanks a lot!

If you want to use Zenarmor with WG, you've to install Wireguard Go instead of Wireguard (remove os-wireguard, install os-wireguard-go (System: Firmware -> Packages))

Zenarmor is currently not able to detect the WG Kernel Module interfaces. I guess this will resolve your "Cannot validate interface" issue.

The issue that we have is, that Zenarmor is able to detect the WG interfaces, but it can't inspect the traffic due to the missing TUN  patch.

[franco]

# opnsense-update -zkr 23.7.2-tun
# opnsense-shell reboot


Cheers,
Franco

[wirefall]

Thanks a lot Franco, the results:

1. Alerts ("Cannot validate interface:...") are not showing up anymore so far, also no engine stop

2. Dashboard Traffic still only shows dead flat lines for wg interface, and in Live Sessions there is no wg data

So I guess the engine stop is fixed with your tun patch

Now waiting for wireguard-kmod netmap support. Thanks in advance to Zenarmour team addressing this important feature! 

[JasMan]

YAY! It's working again! 

WG traffic is inspected and blocked as before the OPNsense update. Thanks a lot for your support!

[wirefall]

Hey @franco,

Thanks for the heads-up. Yes, it the tun patch is not in 23.7, that must be the reason.

Looking forward to the test kernel; team will go ahead and test it.

WRT wireguad-kmod netmap support, we're working on it to see whether it would be feasible to develop/maintain. We'll reach out to the team once we have some meaningful progress.

Any news regarding wireguad-kmod netmap support? Thanks a lot 

[sy]

Hi all,

Thank you for your inquiry. I am pleased to inform you that we plan to support it before the release of OPNsense 24.1 version. If you have any further questions or concerns, please do not hesitate to contact to Zenarmor team.

Best regards,

[wirefall]

this is really great news, thank you very much indeed!