[Tutorial] Selective Routing to Private-VPN (via Wireguard)

[balrog]

Introduction

In the following I would like to show how I have set up "Selective Routing" via Wireguard. Primarily to access websites with region lock or to hide my real public IP.
For that, I have an Azure VM, which is located in the appropriate country. This VM can also be from another provider.

This manual is basically based on: https://docs.opnsense.org/manual/how-tos/wireguard-selective-routing.html

Tested and working on OPNsense 22.1.2_1


Changelog

17.03.2022:

• Changed the Gateway-Address from local WG-Address to the remote WG-Address (Local WG-Gateway), as described in the official manual.
• Fixed some typos an formatting

Requirements

• Wireguard Plugin installed (on OPNsense)
• Endpoint with fixed, public IP
• Endpoint OS: RockyLinux 8.5

Configuration: OPNsense

Create Endpoint
Go to: VPN -> Wireguard -> Endpoints -> + (create new)

• Set "Enable"
• Your prefered Name
• Keep this field empty
• Insert: 0.0.0.0/0 (for IPv6: ::/0
• Insert the Public IP from your Endpoint
• Any Port you want to use
• Since this is supposed to be a persistent connection, set the keepalive to 25

Click on "Save" and "Apply"

Create Local Configuration

• Enable "advanced mode"
• Set "Enable"
• Your prefered Name
• Keep this fields empty
• In this case we don't need a Listening-Port
• Set the Tunnel Address x.x.x.x/32
• Select the previously created Endpoint
• Select "Disable Routes"
• Choose any Gateway-IP in the same Range as the Tunnel Adress in /24

Click on "Save" and "Apply"

Click on "Edit" (Pencil) and copy the new generated Public Key to a .txt-File or similar.

Create new Interface
Go to: Interfaces -> Assignments

• Assign the new created Wireguard interface

Go to: Interfaces -> [NEW-WG-INTERFACE]

• Set everything as on the screenshot and click on "Save"

• Now restart WireGuard - you can do this from the Dashboard (if you have the services widget) or by turning it off and on under VPN -> WireGuard -> General

Create a Gateway
Go to: System -> Gateways -> Single

• Your prefered Name
• Select your [NEW-WG-INTERFACE]
• Select IPv4
• Enter the gateway IP that you configured under the WireGuard local peer configuration
• Select "Far Gateway"
• Enter the Gateway IP from your Local Wireguard Configuration

Click on "Save" and "Apply changes"

Create Aliases (Destination URLs, Networks)

Go to: Firewall -> Aliases -> Add (create new alias)

In my case, certain services are loaded from my accessed website via a CDN, which is why I also need to enter all the subnets used by the CDN. If this is not the case for you, you can simply create a URL alias and skip creating a network alias.

URL:

• Your prefered Name
• Select "Host(s)"
• Enter every single used Hostname/FQDN, because OPNsense isn't supporting Wildcard.
  (e.g. www.google.com, google.com)

Click on "Save" and "Apply"

Networks:

• Your prefered Name
• Select "Network(s)"
• Enter every used subnet

Click on "Save" and "Apply"

Firewall Rules

In my case the complete internal network should run through my wireguard endpoint when accessing my "region block website".
If you don't want to do that over the whole network, you can also create an alias for the affected IPs/hosts and specify them as "source" later. in the Rule-Creation.

Go to: Firewall -> Rules -> [LAN-Interface] -> Add (create new rule)

• Select your LAN-Interface
• Select "IPv4"
• Select your LAN-Network (net) or your defined IPs/Hosts-Alias
• Select your defined URL-Alias
• Select your defined Gateway

Click on "Save" and "Apply"

If you have also created a Network-Alias like me, this just created firewall rule needs to be copied and the destination (4) needs to be adjusted to this alias. After that "Save" and "Apply" again.

NAT Configuration
The NAT is only needed if you also want to access the endpoint host itself!

Go to: Firewall -> NAT -> Outbound

Select "Hybrid NAT..."


Add a new "Manual rule":

• Select your Wireguard-Interface
• Select "IPv4"
• Set Translation to "Interface address"

Click on "Save" and "Apply"

Now we are basically done with the configuration on the OPNsense side. We only have to enter the PublicKey of the Wireguard endpoint later.

Configure: Rocky Linux / Wireguard-Endpoint

At this point you can use any Linux/BSD distribution as long as iptables and wireguard are available for it.
However, only the procedure on RockyLinux is described here.

Installation prerequisites / Wireguard

Install Epel-Release:

Code Select Expand

dnf install epel-release -y

Install Wireguard:

Code Select Expand

dnf install kmod-wireguard wireguard-tools -y

Create WireGuard Configuration Directory

Code Select Expand

mkdir /etc/wireguard

Generate WireGuard Private/Public Keys

Change Permissions:

Code Select Expand

umask 077

Generate and write a new private and a public key to a file:

Code Select Expand

wg genkey | tee /etc/wireguard/wireguard.key | wg pubkey > /etc/wireguard/wireguard.pub.key

Copy the created private key and write it temporary somewhere down:

Code Select Expand

cat /etc/wireguard/wireguard.key

Create a new Wireguard-Configfile:

Code Select Expand

vi /etc/wireguard/wg0.conf

Paste the following lines to this file:

Code Select Expand

[Interface]
ListenPort = 55555
PrivateKey = [PrivateKey from the Endpoint/this Machine]
Address = 10.0.8.1/32
PreUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PreUp = iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

[Peer]
PublicKey = [PublicKey from OPNsense-Wireguard]
AllowedIPs = 10.0.8.2/32

Note that on my interface eth0 the gateway is defined. This may be different for you. Change it accordingly in the lines "PreUp" and "PostDown".

Save the File (vi = :wq)

Enable IP-Forwarding

Code Select Expand

echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf

Code Select Expand

sysctl -p


Copy the public key to OPNsense

Copy the created public key and write it temporary somewhere down:

Code Select Expand

cat /etc/wireguard/wireguard.pub.key

Go back to your OPNsense WebGUI
Go to: VPN -> Wireguard -> Endpoints -> Edit your prevoiusly created config

• Paste the public key into the "Public Key"-field

Click on "Save" and "Apply"

Start Wireguard on the Endpoint
Go back to your Endpoint and start your Wireguard-Tunnel:

Code Select Expand

wg-quick up wg0

If your tunnel is already running, do:

Code Select Expand

wg-quick down wg0

Code Select Expand

wg-quick up wg0

You can check if the tunnel is up and running:

Code Select Expand

wg

Create a service

Code Select Expand

systemctl start wg-quick@wg0

Code Select Expand

systemctl enable wg-quick@wg0

Summary
Now we are ready and you can test/use your configuration.

[wrobelda]

In "Create a Gateway" section, step "4. Enter the Tunnel Address from your Local Wireguard Configuration" is inconsistent with https://docs.opnsense.org/manual/how-tos/wireguard-selective-routing.html#step-6-create-a-gateway.

[balrog]

Hi wrobelda

Thanks for the hint! I have adjusted the section in the tutorial. Nevertheless, it also works when the tunnel address is entered.

[LennieSmalls23]

Thanks you balrog for this, this tut was reassuring for me to read as I had followed the official guide which did not suffice my needs like yours.

To note for anyone else i had to move the rule to the top as i already had an any out rule on the lan which was taking precedent.

I have been using opnsense for a few months now and the journey has been great so far, this has just topped it off.

Thanks!