Wireguard stopped working OPNsense 22.7.2

[Rhabarbertorte]

Hello together,

Since the last update to OPNsense 22.7.2, none of my wireguard tunnels work anymore. I never had a problem with Wireguard and OPNsense before, how can this be?

Am I the only one for whom Wireguard no longer works?

The error image shows that traffic reaches the Wireguard server on my OPNsense and the server supposedly responds (see image) --> however, this traffic does not reach the endpoints on the other side.



I also did a complete reinstall of OpnSense and played back a backup. Problem stays the same.

[Rhabarbertorte]

I have some addition: This is what a wireguard log looks like. I captured on WAN side.

Is 0.0.0.0 as sender OK? Looks not right.

[nzkiwi68]

That peer only allows traffic coming from a single IP address of 10.48.150.2 and nothing else.

Normally, the peer would have at least 2 sets of IP addresses:
10.48.150.2/32 (the tunnel peer IP address I assume)
PLUS say 192.168.83.0/24 - the LAN subnet, or whatever subnet or subnets from that peer

See my peer partner in my setup:

Code: [Select]

peer: wx5ahL.....................
  preshared key: (hidden)
  endpoint: 202.XXXX.XXXXX.244:51820
  allowed ips: 192.168.83.0/24, 10.1.18.1/32
  latest handshake: 3 days, 6 hours, 46 minutes, 6 seconds ago
  transfer: 35.49 KiB received, 28.43 KiB sent

192.168.83.0/24 is the LAN subnet of the other side
10.1.18.1/32 is the peer's tunnel IP address (and my end happens to be 10.1.18.2/24)

[Rhabarbertorte]

That peer is a smartphone, therefore only one ip is correct.

[Demusman]

That peer is a smartphone, therefore only one ip is correct.

This worked fine without the tunnel as allowed?

Did you try to delete and recreate the tunnel?

[Rhabarbertorte]

I was able to narrow down the problem even further.
Now it's getting really interesting!

Everything that leaves the firewall and is not bound by IP to a specific interface, e.g. ping, goes out with the source ip 0.0.0.0. Therefore no response is received.

See screenshot.

[mimugmail]

Seems you have a broken nat rule.
Check them please

[Rhabarbertorte]

I was able to fix it. But don't ask me how. Tried so many things.
Most likely it was related to a old failover interface (not connected).