OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • English Forums »
  • Virtual private networks »
  • Wireguard & Mullvad - I'm lost.....
« previous next »
  • Print
Pages: [1] 2 3 ... 6

Author Topic: Wireguard & Mullvad - I'm lost.....  (Read 36941 times)

chbmb

  • Newbie
  • *
  • Posts: 26
  • Karma: 3
    • View Profile
    • LinuxServer.io
Wireguard & Mullvad - I'm lost.....
« on: November 24, 2019, 04:29:31 pm »
So I recently migrated to OPNsense from Pfsense, I'm very impressed and glad I made the switch.  I've been experimenting with WireGuard a fair bit and have written a couple of blog posts on my progress so far with an OPNsense WireGuard "server" and Android and Ubuntu desktop "clients", so my next step was to try and setup Mullvad as the "server" and OPNsense as the "client"

I've been referencing the guides below:

https://wiki.opnsense.org/manual/how-tos/wireguard-client-mullvad.html
https://wiki.opnsense.org/manual/how-tos/wireguard-client-azire.html
https://www.routerperformance.net/opnsense-wireguard-plugin-azirevpn/

I can get the tunnel up, as evidenced here. (wg1, wg0 is my "WireGuard server for connection to my LAN remotely." and am using a custom port to receive the incoming connection.









(If I do not disable routes then I find all my internet access from LAN disappears.)

Undeterred I figured some manual routing would work and give me more granular control over things, so I created an interface.



and added a firewall rule



But traffic is still going out over WAN, rather than the Mullvad interface.  I tried to create a gateway, as shown here



and can manually bring it up, by clicking on the grey arrow, although I'm not sure how having the gateway really changes anything given my existing NAT rule.



I'm obviously missing something, but I'll be damned if I know what, and if anyone can give me some pointers I'd be very grateful indeed.

Sorry for the lengthy post/pictures, but figured it would be better to have too much information, rather than not enough.

Thanks

C
« Last Edit: November 24, 2019, 04:44:01 pm by chbmb »
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 6286
  • Karma: 432
    • View Profile
Re: Wireguard & Mullvad - I'm lost.....
« Reply #1 on: November 24, 2019, 05:20:12 pm »
You need to put an IP address into gateway and also add this IP in gateway field in local instance. Then you can do routing via Firewall rules
Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

chbmb

  • Newbie
  • *
  • Posts: 26
  • Karma: 3
    • View Profile
    • LinuxServer.io
Re: Wireguard & Mullvad - I'm lost.....
« Reply #2 on: November 24, 2019, 05:28:13 pm »
Quote from: mimugmail on November 24, 2019, 05:20:12 pm
You need to put an IP address into gateway and also add this IP in gateway field in local instance. Then you can do routing via Firewall rules

Forgot to mention that I'd tried that and got the error message:

Quote
"The gateway address "10.249.0.1" does not lie within one of the chosen interface's IPv4 subnets."

So the thing that confuses me, is which IPV4 subnet is applicable to the Mullvad interface?  Another IP in the same range as the tunnel address?
Logged

chbmb

  • Newbie
  • *
  • Posts: 26
  • Karma: 3
    • View Profile
    • LinuxServer.io
Re: Wireguard & Mullvad - I'm lost.....
« Reply #3 on: November 24, 2019, 05:40:58 pm »
Ah, OK, added the IPV4 tunnel address on my local Mullvad WireGuard instance as the Gateway IP.  That worked.

I'm still not getting my traffic routed over the interface though, so presumably I need to add another rule in somewhere?
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 6286
  • Karma: 432
    • View Profile
Re: Wireguard & Mullvad - I'm lost.....
« Reply #4 on: November 25, 2019, 05:55:37 am »
Firewall rule in LAN tab and add there the mullvad gateway :)
Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

chbmb

  • Newbie
  • *
  • Posts: 26
  • Karma: 3
    • View Profile
    • LinuxServer.io
Re: Wireguard & Mullvad - I'm lost.....
« Reply #5 on: November 27, 2019, 04:43:32 pm »
Sorry, I'm probably being stupid here, I've tried doing as you suggested.  Something happens, basically any traffic in my browser is redirected to my OPNsense install.   :o

I've put a gateway IP into the local instance
(Doesn't work if I leave out the /32 - tunnel doesn't come up or show in "List configuration")

Local Instance



Endpoint



List Configuration



I've created the interface for Mullvad



And then a gateway with the assigned IP of the tunnel address of the local instance





So I think everything up to this point is good.  :D

I'm going to guess it's the following bits that have me confused, as I'm clearly missing something, and I'm sure those wiser than me will laugh at my mistake......

I've got an Outbound NAT rule



A Mullvad NAT Rule



And finally a LAN Firewall Rule (deactivated at the moment as enabling it results in everything redirecting to my OPNSense address. 



Really appreciate the advice.  Sorry for another lengthy post.
Logged

actionhenkt

  • Newbie
  • *
  • Posts: 49
  • Karma: 2
    • View Profile
Re: Wireguard & Mullvad - I'm lost.....
« Reply #6 on: November 28, 2019, 10:59:23 pm »
I have tried to get this working with mullvad aswell, got it working once for 10minutes. I will try again this weekend if I can get it stable I can share the configuration with you.

I noticed you use hybrid nat on your wan and your source on it is any, the auto nat rules also contain your mullvad interface on wan, im not sure the manual nat rule for the mullvad interface will work here.. have you tried manual outbound nat ? I would also then remove the source "lan net" from your lan rule and make it source any and put the mullvad gateway back into your lan in rule to test if it works at all (if it does you can try an alias containing ip's as source next). You could also try to set a local tag on the lan in rule and match the tag on the outbound nat rule for the mullvad interface (in a manual nat configuration).
Logged

chbmb

  • Newbie
  • *
  • Posts: 26
  • Karma: 3
    • View Profile
    • LinuxServer.io
Re: Wireguard & Mullvad - I'm lost.....
« Reply #7 on: December 01, 2019, 01:13:27 am »
Quote from: actionhenkt on November 28, 2019, 10:59:23 pm
I have tried to get this working with mullvad aswell, got it working once for 10minutes. I will try again this weekend if I can get it stable I can share the configuration with you.

I would be very grateful.   ;D

Quote
I noticed you use hybrid nat on your wan and your source on it is any, the auto nat rules also contain your mullvad interface on wan, im not sure the manual nat rule for the mullvad interface will work here.. have you tried manual outbound nat ?

I haven't tried manual outbound NAT, I thought with hybrid that rules were applied in order from top down.

Quote
I would also then remove the source "lan net" from your lan rule and make it source any and put the mullvad gateway back into your lan in rule to test if it works at all

Unfortunately, it still didn't work

Quote
(if it does you can try an alias containing ip's as source next). You could also try to set a local tag on the lan in rule and match the tag on the outbound nat rule for the mullvad interface (in a manual nat configuration).

It's my end intention to make it a bit more granular in terms of clients that use the Mullvad tunnel, just figured making it as simple as possible to start with.

Not that it's been as simple as I'd originally hoped.....

Thanks for the reply, if nothing else it's reassuring to know others have had difficulty too....
Logged

tusc

  • Newbie
  • *
  • Posts: 31
  • Karma: 4
    • View Profile
Re: Wireguard & Mullvad - I'm lost.....
« Reply #8 on: December 03, 2019, 10:20:59 pm »
Count me as another user trying to get wireguard to work with policy based routing. I tried months ago with no luck. Hopefully someone figures it out.
Logged

chbmb

  • Newbie
  • *
  • Posts: 26
  • Karma: 3
    • View Profile
    • LinuxServer.io
Re: Wireguard & Mullvad - I'm lost.....
« Reply #9 on: December 04, 2019, 01:41:03 am »
Quote from: tusc on December 03, 2019, 10:20:59 pm
Count me as another user trying to get wireguard to work with policy based routing. I tried months ago with no luck. Hopefully someone figures it out.

Well that's three of us that are struggling!  If nothing else you've made me feel better about not being able to get it working.

Perhaps I'm not quite as dumb as I thought!   ;D
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 6286
  • Karma: 432
    • View Profile
Re: Wireguard & Mullvad - I'm lost.....
« Reply #10 on: December 04, 2019, 05:53:35 am »
Can you ping me via IRC? I can have a look via Teamviewer
Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

chbmb

  • Newbie
  • *
  • Posts: 26
  • Karma: 3
    • View Profile
    • LinuxServer.io
Re: Wireguard & Mullvad - I'm lost.....
« Reply #11 on: December 04, 2019, 08:48:02 am »
Quote from: mimugmail on December 04, 2019, 05:53:35 am
Can you ping me via IRC? I can have a look via Teamviewer
Yeah, will do when I get back from work and we'll try and work out a time.  Thanks for that!

Sent from my Mi A1 using Tapatalk

Logged

spants

  • Newbie
  • *
  • Posts: 10
  • Karma: 1
    • View Profile
Re: Wireguard & Mullvad - I'm lost.....
« Reply #12 on: December 04, 2019, 08:01:16 pm »
Count me in as another user trying to do the same!.
I have everything running on PIA OpenVPN (including routing for ports/devices) but wanting to switch to Mullvad Wireguard after the recent news.....

I have the wireguard server running on my opnsense - it's awesome!

(hi CHBMB - from another unraid guy!)
« Last Edit: December 04, 2019, 08:03:43 pm by spants »
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 6286
  • Karma: 432
    • View Profile
Re: Wireguard & Mullvad - I'm lost.....
« Reply #13 on: December 04, 2019, 08:06:23 pm »
I fixed it with him, he will write a guide
Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

chbmb

  • Newbie
  • *
  • Posts: 26
  • Karma: 3
    • View Profile
    • LinuxServer.io
Re: Wireguard & Mullvad - I'm lost.....
« Reply #14 on: December 04, 2019, 08:45:50 pm »
Quote from: spants on December 04, 2019, 08:01:16 pm
Count me in as another user trying to do the same!.
I have everything running on PIA OpenVPN (including routing for ports/devices) but wanting to switch to Mullvad Wireguard after the recent news.....

I have the wireguard server running on my opnsense - it's awesome!

(hi CHBMB - from another unraid guy!)

Hello mate, I recognise the name!

Quote from: mimugmail on December 04, 2019, 08:06:23 pm
I fixed it with him, he will write a guide

You did, I'm still fiddling with a few things which I think are DNS related.  But yeah, definitely able to get stuff routed down the tunnel now.
Logged

  • Print
Pages: [1] 2 3 ... 6
« previous next »
  • OPNsense Forum »
  • English Forums »
  • Virtual private networks »
  • Wireguard & Mullvad - I'm lost.....
 

OPNsense is an OSS project © Deciso B.V. 2015 - 2023 All rights reserved
  • SMF 2.0.19 | SMF © 2021, Simple Machines
    Privacy Policy
    | XHTML | RSS | WAP2