WireGuard help to access Internet, AdGuardHome and specific VLANS (Os v26.7)

[danman]

Hey

I'm currently setting up OPNsense (v26.7) and WireGuard. The installation of OPNsense is brand new on bare metal.
Currently I'm trying to have at least internet access and access to all LANs.

My network skills are very limited so to lock down LAN again and allow specific LANs/VLANs only etc. will follow after that :)

The connection to wireguard in my home network and extern works without any issues.
The client "AllowedIPs" is set to "0.0.0.0/0, ::/0".

I've no NAT rules yet, only the open port on the WAN interface. And here is where I'm struggling. I created first a "Destination NAT" and chose "Register rule" under "Firewall rule" first which worked too but still no access to the internet or LAN.
I read something about "Source NAT" and to enable "Hybrid Source NAT rule generation".

But it instead of mucking around and enabling and open this and that I would like to ask first to have a proper configuration. The docs are currently for the older versions I assume - https://docs.opnsense.org/manual/how-tos/wireguard-client.html so this doesn't help me at the moment as well.

Anyhow, I hope someone has the time to guide me through my configuration.

Thank you!
Dan

[danman]

Ok internet works ... kind of.

If you are looking for the same issue, here is just the set up if you use straight unbound:

Code Select Expand

Firewall -> Rules -> Add

 Description = WireGuard internet access
 Interface = HomeWireGuard
 Action = Pass
 Direction = Both
 Version = IPv4
 Protocol = Any
 Source = Single host or Network (10.10.10.0/24)
 Source Port = Any
 Destination = Any
 Destination Port = Any


I'm using AdGuardHome on OPNsense.

Code Select Expand

AdGuardHome (port 53) -> Upstream DNS servers 192.168.101.1:5353 (Unbound Port changed to 5353)
I have the following issue that for some reason when AdGuard is involved that my VPN clients request and the following reply includes also the wireguard interface IP. As seen in the following through Unbound everything works fine.

Unbound only:

Code Select Expand

16:32:01.282074 IP 10.10.10.2.59972 > 192.168.101.1.53: 50781+ [1au] A? google.com. (51)
16:32:01.282137 IP 192.168.101.1.53 > 10.10.10.2.59972: 50781 1/0/1 A 142.250.195.110 (55)
with adguardhome:

Code Select Expand

16:33:36.498148 IP 10.10.10.2.41034 > 192.168.101.1.53: 58975+ [1au] A? google.com. (51)
16:33:37.045166 IP 10.10.10.1.53 > 10.10.10.2.41034: 58975 1/0/1 A 142.250.195.110 (55)

Why is it not passing it directly as well (192.168.101.1.53 > 10.10.10.2).

[danman]

Ok AdGuardHome is solved as well so far. It might needs to be changed again once VLANs are created etc. but the solution here was to change the config file of AdGuardHome

Code Select Expand

/usr/local/AdGuardHome/AdGuardHome.yaml

Code Select Expand

dns:
  bind_hosts:
    - 192.168.101.1
I had before every interface 0.0.0.0.