Validating the WireGuard VPN Communication Flow in OPNsense

[marsk]

Hi,

To better understand what I was actually configuring in the OPNsense web UI, I created a logical diagram to help me.
The diagram (Attached file) shows how traffic flows through OPNsense when using a WireGuard VPN.

However, I need help verifying that the diagram is correct. Could you please verify it for me?

//marsk

[meyergru]

I think the main problem with the diagram is that it mixes different abstraction layers and then shows them as if they were consecutive hops in the packet path.

For example:

• The gateway and the VLAN interface are not really separate hops. From the client's point of view, the gateway normally is an IP address on the OPNsense VLAN interface.
• A WireGuard interface, instance and peer are not three consecutive network elements either. The instance provides the WireGuard interface, while the peer is configuration belonging to that instance.
• The firewall is not one single box which the packet passes only once. Filtering happens at specific interfaces/directions and state tracking is involved.
• With WireGuard there are also two packet layers: the inner IP packet and the outer encrypted UDP packet.

Very simplified, outbound traffic would look more like:

Code Select Expand

Client
-> VLAN
-> OPNsense VLAN interface
-> firewall / routing decision
-> WireGuard interface
-> WireGuard processing / peer selection / encryption
-> WAN interface
-> ISP / Internet
-> remote WireGuard peer

And incoming traffic:

Code Select Expand

remote WireGuard peer
-> Internet / ISP
-> WAN
-> firewall (encrypted UDP packet)
-> WireGuard processing / decryption
-> WireGuard interface
-> firewall / routing (inner IP packet)
-> VLAN interface
-> Client

So I would probably either draw a packet-flow diagram, or a configuration-object diagram showing the relationships between VLANs, interfaces, WireGuard instances and peers.

Mixing both concepts into one left-to-right chain is what makes the current diagram somewhat misleading.

[marsk]

Thx,
It is the configuration that is the problem, so it is probably better, as you said, to create a configuration diagram.

I have attached a flow diagram based on your suggestion, if I got it right.

See you.

//marsk

[nero355]

if I got it right.

IMHO both attempts are OK and if it's enough for you as a reminder from time to time then that's perfectly fine, right ?!

I would personally create something like this :
- Draw a Client device.
- Then a huge circle representing OPNsense Firewalling.
- On the left edge of that circle one of your LAN Interfaces with the remark that it's also holds the Gateways for the VLANs and thus any VLAN Interfaces.
- Then a line from the Client device to the LAN Interface.
- Under that line Ethernet and again under it another one with any VLANs.
- On the right middle side of the circle one of your WireGuard interfaces.
- On the right edge of that circle one of your WAN Interfaces.
- Then a line representing let's say Ethernet over Fiber being used to connect to your ISP that is a small cloud outside the circle.
- In the middle of the circle the Routing/NAT Engine of OPNsense connected to every Interface except WAN.
- However you also need seperate "Just Routing" connections to the LAN and WireGuard Interface so maybe doing something seperate with NAT would be better ?!
- The Remote WireGuard Peer would be connected to the previously drawn small cloud outside the circle.
- And then a long VPN connection line all the way from the WireGuard Interface to the Remote WireGuard Peer.

And last but not least : Put the whole WireGuard processing/peer selection/encryption process in a seperate drawing and maybe connect it to the WireGuard Interface ?? :)



/"Quick Brainfart" which might have some mistakes or missing things in it...

[marsk]

Thanks nero355

Can you please just take some pen and paper and make a drawing of what you see in your mind .

You do not need to write the name of the components just visualize them with a box of any kind,
and attach a photo so I can try to make a logical diagram.

//marsk

[marsk]

Not only understanding the flow is important for me.

I have worked as an infrastructure architect for many years on servers, virtualization, and storage,
not networks, and I am dyslexic.

Having a diagram gives me a grip of a system within three seconds, and the same goes for my colleagues and customers.
All documentation I write for systems I deploy always starts with a diagram.

So I really want to thank you for helping me.

I also think the documentation for OPNsense really could benefit from some diagrams for easier understanding.

//marsk