How can we nat a remote network using vxlan wireguard ?

[Damien66]

Hello,
  I have configured two remote sites to share the same vlans, the same addresses.
The sites are connected via VXLAN through a wireguard tunnel. For this, I used and added the two docs :
- https://docs.opnsense.org/manual/how-tos/wireguard-s2s.html
- https://docs.opnsense.org/manual/how-tos/vxlan_bridge.html
The configuration works. I get DHCP when I connect a pc to the different vlans on the remote site.
I can ping between a pc on site A and a pc on site B (and vice versa).

It's almost perfect BUT...the remote client cannot access the Internet (no NAT)
However, the local client can go internet (same DHCP server, same vlan, same gateway). For me, the configuration of the local and remote client is similar.

In the test below, we see a ping from the local client (192.168.50.44 VLAN50) to 8.8.8.8.
You can see that it's pinged to my public output 82.XX.XX.64 (WAN)... and so the “echo reply” is perfect.

Code: [Select]

------------------------------------------------------
NAT works on vlan50's for local host
--------------------------------------------------------
VLAN50Free
vlan0.50 2024-11-22
09:55:03.071020 0c:b2:b7:cf:da:8e a8:b8:e0:01:ef:b3 ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 50629, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.50.44 > 8.8.8.8: ICMP echo request, id 27503, seq 1, length 64

InternetWAN
igc0 2024-11-22
09:55:03.071099 a8:b8:e0:01:ef:b1 20:66:cf:60:32:31 ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 63, id 50629, offset 0, flags [DF], proto ICMP (1), length 84)
    [b]82.XX.XX.64 > 8.8.8.8[/b]: ICMP echo request, id 11344, seq 1, length 64

InternetWAN
igc0 2024-11-22
09:55:03.087745 20:66:cf:60:32:31 a8:b8:e0:01:ef:b1 ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 118, id 0, offset 0, flags [none], proto ICMP (1), length 84)
    8.8.8.8 > 82.XX.XX.64: ICMP echo reply, id 11344, seq 1, length 64

VLAN50Free
vlan0.50 2024-11-22
09:55:03.087763 a8:b8:e0:01:ef:b3 0c:b2:b7:cf:da:8e ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 117, id 0, offset 0, flags [none], proto ICMP (1), length 84)
    8.8.8.8 > 192.168.50.44: ICMP echo reply, id 27503, seq 1, length 64
But the remote PC (passing through wireguard, arriving on bridge between vxlan and opt2) can't go online. No NAT.
Yet this remote pc 192.168.50.45 can ping 192.168.50.44 (local pc) and 192.168.50.1 (vlanFree interface ip)

Code: [Select]

----------------------------------------------------------
But a remote host doesn't go internet. No NAT
----------------------------------------------------------
VLAN50Free
vlan0.50 2024-11-22
09:53:46.895976 ec:b1:d7:99:25:9c a8:b8:e0:01:ef:b3 ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 128, id 53111, offset 0, flags [none], proto ICMP (1), length 60)
    192.168.50.45 > 8.8.8.8: ICMP echo request, id 1, seq 236, length 40

InternetWAN
igc0 2024-11-22
09:53:46.896003 a8:b8:e0:01:ef:b1 20:66:cf:60:32:31 ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 127, id 53111, offset 0, flags [none], proto ICMP (1), length 60)
    [b]192.168.50.45 > 8.8.8.8[/b]: ICMP echo request, id 1, seq 236, length 40
We can see that the ip on the InternetWAN interface should be my public ip 82.XX.XX.64... but it tries with the local ip 192.168.50.45. Of course it doesn't work.
Any ideas? Why does opnsense manage differently a local pc and a remote pc having the same network in the same vlan?
Thank you very much

[Monviech (Cedrik)]

Try creating an Alias with RFC1918 networks.

In your current NAT rule, replace Source with that Alias.

That way any RFC1918 address will be NATed before they go out of the WAN interface.

[Damien66]

I've tried but it doesn't make any difference. The local pc in 192.168.50.44 goes to the Internet and the remote pc in 192.168.50.45 doesn't go to the Internet.
In fact, instead of to nat 192.168.50.0/24 (VLAN50Free net ), it is all the local networks with this modification.

The very strange thing is why opnsense handles two PCs on the same LAN differently.

[Monviech (Cedrik)]

I still have my vxlan test setup from writing the docs. I can test how NAT behaves when packets pass from one bridge to the other over the vxlan tunnel.

There might be some limitations I have not seen.

[Damien66]

If you can test it, I'd like to.
I've probably activated or deactivated a parameter, or made a configuration error.
But I can't find the trick