Noob trying to get Wireguard on vlans, would be nice to know

[RoWAN Tree]

Hi I'm a noob trying this for the first time. I have been trying to get wireguard to work on a diy mini pc for over a month, I pay for internet but don't want to use the router they sent me so I bought the mini PC and installed opnsense.. I bought a TpLink TLSG108E managed switch and that been setup as well, my issue is that I can't connect to wireguard I put all the information in and try the DNS settings but I get lost because I don't understand everything, it locks me out then I have to reinstall and do everything again. Chatgpt sucks because it keeps freezing in the middle of setting up. I am having burnout with this and I haven't even got a working connection to the internet yet.. As a noob please add an update to your documentation tutorials because you update the software but then the tutorials become obselete..  If someone can help me figure this out would be cool. this is my last attempt at trying to solve this before abandoning the idea of having a private network, thanks for anyone's time!

[nero355]

- Press the ENTER key from time to time.
- VLANs and Wireguard are two seperate things.

What are you trying to achieve exactly ?

I am guessing to have multiple VLANs and only one of them will have Internet Access via the Wireguard VPN ?

What does your setup look like and what did you try so far ?
Please be specific!

[Noci]

One step at a time.....
Setup VLANs..., with the right IP addresses. and setup DHCP etc. as wanted.
Ensure this works to satisfaction.  Then in the VLAn with internet access lets' assume it's 172.16.1.0/24

Then configure wireguard, ensure there is a keepalive timer for about 120 seconds. and Allow traffic (local) from 172.16.1.0/24
The peer part should be allow traffic 0.0.0.0/0, ::/0 (ipv6).

Then if wireguard starts (firewall in client mode), it should get the link up.  (Wireguard has no concept of VLAN's   just setup routing for one block of addresses to another block.
Also the firewall SHOULD allow traffic from 172.16.1.0/24 -> 0.0.0.0 ....

You can show config with public & privatekeys editted. (do include the IP ranges for LANs you like to route etc.).

[RoWAN Tree]

Hi thanks for the reply.. I copied from notepad just written out. I'm trying to get OpnSense working in general with Wireguard and the vlans.

I have a modem in bridge mode provided by my isp to the (WAN) of The mini PC. It is OK and working I have 2 NICs 128ssd 4gb ram. I installed the Zfs with no other partitions, wiped fresh.

From mini PC (LAN) to switch port 1. I guess that's the trunk? I have 8 port Tp link TLSG108E managed.

I wanted to do the installation and setup offline until the end to test the VPN and kill switch. I want all vlans to go through wireguard VPN no fallback on ISP. I want to have the management local only through wired offline connection.

I did have this working somewhat with no loss to web ui but I changed something while doing DNS and it lost access..

I have 4 vlans set up,
Port1- Trunk
Port2,6- Vlan20 for PC
Ports3,4,5 - Vlan10 for consoles
Port7 - Vlan30 Guest (WiFi ap later)
Port8 - Vlan99 Management

I think everything is setup correctly up until I started doing dnsmasq and dhcp. I don't understand these and used chatgpt but got locked out of the web ui.

I can access when I hook a keyboard up to the mini pc and enter shell, then pfctl -d, that let's me access again from My management vlan99 on port 8.
Then once I log in on PC, I enter pfctl -e in shell to activate it again.

I can change whatever and log out log in but as soon as I close the broswer it wipes the data on there and I can't get back in whereas before I could after clearing cookies and data.

I've got a handshake from wireguard but I can't access the internet from anything so I searched what it could be, suggestions were dns, firewall rules, dhcp, I've never fully went to a website or anything online yet.

 I started to attempt to fix that, but lost access now I have multiple problems and I'm not much of a tech person, I do know a little bit I'm trying to learn as much as I can.

The bit about the tutorials is for the killswitch floating rule.

The tutorial says to make a floating rule for the WAN to interface with matching tag to block ISP fall back if connection is lost, but when I click apply on that rule it disappears from floating rules and ends up under WAN rules instead. Its confusing for me to understand when I don't know the basic all that well, this seems for far more advanced people than for my level 😅

I used chatgpt for this whole setup guide so far I told it to use opnsense.org documentation for any reference and no guessing if that helps any.. I dont want to come into a space im still learning about by using ai to do it for me i want to actually learn how to get this running.

I hope that can give a better picture of what I have going on. I don't know what you need to know for my settings but just let me know.