(SOLVED) Troubleshooting: Wireguard VPN via ProtonVPN not working

[opn_minded]

Dear all,

could you please help me with the following; I'm a Proton(VPN) user and set up a Wireguard VPN connection following https://docs.opnsense.org/manual/how-tos/wireguard-client-proton.html, respectively https://docs.opnsense.org/manual/how-tos/wireguard-selective-routing.html (as step 6 and ongoing).

Sidenote; the only difference would be that I've set up the according rules as floating, as the clients which shall use the tunnel reside in different VLANs.

The WG instance is "up", the corresponding peer has a recent handshake entry.
The gateway is "online" with 0.0 loss.

Now to my issue -> as soon as I enter my mobile phone for testing to the alias (clients which shall use the tunnel), I can't reach any non-internal hosts anymore (browsing the web, Firefox shows a black screen and an error message "this website requires a secure connection" / HSTS).

In the FW logs, I can see that the rules that I've added during the setup trigger pass, so no blocks for the test client.

I've ran that setup now three times, but always with the same negative result.

To test the ProtonVPN-conf itself I loaded it directly into my Fritzbox for testing purposes, that's working like a charm (so basically all traffic is now on the tunnel, I could also live with that ).

To summarize;

• the underlying ProtonVPN is working fine -> tested on Fritzbox
• the WG instance/peer combination is working fine -> instance is "up", peer has a recent handshake
• the gateway is online, 0.0 loss

Many thanks in advance for your time in advance!

[DEC670airp414user]

if the tunnel is up.   and you try to view a website and it won't work

it sounds like DNS has not been configured on the client/ tunnel/ Vlan trying to browse

[opn_minded]

Hi there,

I'm Sorry for my late reply, didn't catch your answer (somehow I wasn't notified via eMail). Just wanted to say I've got it working - just followed the guide all over again and now it works .

It seems it had to do with the rule in the affected VLAN that causes the clients to be routed to the WG interface/gateway.