Followed the official wireguard guide, no handshake

[user12314]

I have followed https://docs.opnsense.org/manual/how-tos/wireguard-client.html and I'm not making a handshake. I see on my android wireguard app that data does leave, but no data comes back in my phone.

I read through the guide 3 times to make sure I did it correctly. I used an interface as recommended, and did not make any outbound NAT rules.

I also tried filtering the live view logs for the WAN rule that redirects incoming vpn connections, i did not see any logs.

I tried 2 ports, 51820 and 51830, both did not work.

I'm stuck, can anyone help?

[user12314]

just tried to do a packet capture using interface WAN, port 51830, protocol UDP and nothing showed up when trying to connect to the vpn.

[Patrick M. Hausen]

Is your Uplink behind CGNAT, possibly? Or your OPNsense behind an ISP router? Post the first two octets of your WAN address, please.

[user12314]

Is your Uplink behind CGNAT, possibly? Or your OPNsense behind an ISP router? Post the first two octets of your WAN address, please.

I'm not sure about CGNAT, it is not behind a ISP router, it directly connects to the internet.
`curl icanhazip.com` gives me 94.255 as the first 2 octets.
Thank you

[Patrick M. Hausen]

What does your OPNsense display in Interfaces > Overview or in the Interfaces dashboard widget?

[user12314]

What does your OPNsense display in Interfaces > Overview or in the Interfaces dashboard widget?

There, the wan ipv4 starts with 100.83, and the ipv6 with 2a00:1598

[Patrick M. Hausen]

IPv4 is CGNAT. Your OPNsense cannot be reached from the Internet via IPv4 at all. Use IPv6 for your VPN.

[user12314]

IPv4 is CGNAT. Your OPNsense cannot be reached from the Internet via IPv4 at all. Use IPv6 for your VPN.

okay, thank you

[user12314]

IPv4 is CGNAT. Your OPNsense cannot be reached from the Internet via IPv4 at all. Use IPv6 for your VPN.

i just realized that before i installed opnsense (i switched from pfsense with a separate wireguard vpn server, not part of the pfsense install) that it worked perfectly fine before without ipv6. I never set up any routing for ipv6 on pfsense at least.

Could it be something else too?

[Patrick M. Hausen]

Probably not. Possibly your ISP switched from public IPv4 address to CGNAT when you switched your device and they saw a different MAC address. Call their support, maybe?

[user12314]

good idea, i'll give that a go

[nero355]

IPv4 is CGNAT. Your OPNsense cannot be reached from the Internet via IPv4 at all. Use IPv6 for your VPN.

He could login to the Customer Portal on his ISP's website and check if there is an option to "Order a regular IPv4 address" as one ISP here in The Netherlands calls it :
There are no actual costs involved and the switch from CG-NAT to an regular IP Address is done in somewhere between 6 and 24 hours :)

Others need to be contacted by phone or e-mail and if you are really unlucky it will also cost you € 5 or so per month extra.