WireGuard Site-to-Site selective routing setup changed after the recent upgrade

Started by AegeanDad, September 01, 2021, 02:09:06 PM

Previous topic - Next topic
I have two sites (Site A and Site B) both of which are running OPNSense with a site-to-site WireGuard tunnel. Site A has selective routing set up to route all traffic from a subset of LAN clients to use the WG gateway. Site B doesn't need selective routing; WG is only needed to access LAN clients at Site A and all other outbound traffic uses WAN. The setup is done per these instructions https://docs.opnsense.org/manual/how-tos/wireguard-selective-routing.html (with some trial and error modifications) and it works.

In order to make this work, the instructions above state you have to "Disable Routes" in Site A's local peer. For Site B, it is not needed because WG creates its own routes for the allowed IPs stated in its Endpoints setup.

I did all this and everything works. However, after I upgraded both firewalls to 21.7.1, I noticed the upgrade activated the "Disable Routes" setting at Site B. Puzzled, when I tried to uncheck and save, OPNSense said "You have to enable Disable Routes option". Yet, when I look under Site B's Routes -> Status, I see the appropriate routes set up, possibly remnants of the routes that were previously created when the option was set to no.

Why would that happen?