Noob trying to get Wireguard working on vlans, Help!

[RoWAN Tree]

Hi I'm a noob trying this for the first time. I have been trying to get wireguard to work on a diy mini pc for over a month, I pay for internet but don't want to use the router they sent me so I bought the mini PC and installed opnsense.. I bought a TpLink TLSG108E managed switch and that been setup as well, my issue is that I can't connect to wireguard I put all the information in and try the DNS settings but I get lost because I don't understand everything, it locks me out then I have to reinstall and do everything again. Chatgpt sucks because it keeps freezing in the middle of setting this up every 20 mins. I was setting upDnsmasq Dhcp and lost access to web ui. I am having burnout with this and I haven't even got a working connection to the internet yet..  If someone can help me figure this out would be cool before I give up on Opnsense altogether thanks for anyone's time!

[BoNetTech]

Hi,

Don't give up yet. The usual way out is to go back to a simple setup and add one thing at a time, checking each step before the next:

1. Start with no VLANs at all: WAN on one port, LAN on another, the PC directly on the LAN port. Make sure you get an IP by DHCP and can browse the internet. For DNS, use only ONE service at the start (Unbound, which is the default) and leave the DHCP/DNS settings as they are out of the box.
2. Only then add the VLANs. On a TP-Link TL-SG108E remember it is not enough to put the port in a VLAN: you usually also need to set the PVID of the port. Keep one port untagged on the default VLAN as a safe way back into the web UI.
3. Only after that add WireGuard. WireGuard itself does not depend on VLANs, it needs a working WAN, a firewall rule that allows its UDP port on WAN, and a rule on the WireGuard interface.

To help you better it would be useful to know:
- What do you want WireGuard for: reaching your home network from outside, or sending your traffic through a VPN provider?
- Is your OPNsense behind the ISP router (double NAT) or directly on the internet?
- How many network ports does the mini PC have, and which one is WAN and which is LAN?
- Which OPNsense version are you running (System > Firmware)?

Also, a backup of config.xml (System > Configuration > Backups) before each big change means you never need to reinstall from scratch.

Sergio

[RoWAN Tree]

Hi, thanks for responding. I've been struggling to get opnsense working with wireguard on my vlans. I'm a beginner/ intermediate when it comes to networking and not a tech wizard as some others may be 😅 please keep that in mind. I used chat gpt to use opnsense documentation to make a step by step guide for set all this setup so I'm not sure its 100℅

I have a modem from ISP in bridge mode to the mini PC (WAN)re0 then mini PC (LAN)re1 to switch port 1. I've set up the pvids and vlans pages on the switch as was working before.

I was trying to do this whole setup offline then test the connection afterwards with wireguard. I have 4 vlans that I don't want talking to each other. Wireguard for everything in and out with quad9. I want to have no fallback to ISP once setup. I want the mgnt vlan to just be direct wired offline connection. I don't know how to do that though..

Port 1 default
Ports2,6- Vlan20 pvid20
Ports3,4,5 - Vlan10 pvid 10
Port7 - Vlan 30 pvid30
Port8 - vlan99 pvid99


Opnsense 26.7.8_2

I have setup the interfaces and assignments for vlans and wireguard, I have a handshake as well. The problem I think is dnsmasq dhcp. I dont know what I'm doing to be fair when it comes to this. I changed something on LAN removing a 127.0.0.1 and I lost access to the web ui.
The only way I can get back in is by the mini PC shell (pfctl -d), log back in then (pfctl -e) and it works, but once I close my browser it deletes cookies and data and won't load, keeps timing out, whereas before it didn't do that.

I've set up the ranges on DNS but I'm lost when it comes to the IPS and such. I can ping test 1.1.1.1 or 9.9.9.9 but I can't reach the web on any vlan.

Another thing is to make a floating rule on WAN with no egress tag for kill switch but when I click apply it disappears from floating rules and ends up under WAN rules, I'm not sure if that's supposed to do that or if its a bug..

I'm not sure what else you'd want to know but I can get into the nitty gritty if need be or if its better should I just restart and reinstall? Any help would be much appreciated

[BoNetTech]

Thanks for the details, that helps. I'd fix one thing at a time, and the first one is getting stable access to the web UI again. I suspect it is a firewall/interface issue and not dnsmasq: if it works after "pfctl -d", then "pfctl -e", and stops later, existing connections survive but new ones are blocked.

Please, before changing anything else:
1. Save a backup of config.xml if you can reach the GUI (System > Configuration > Backups).
2. From the PC on switch port 1, tell me which IP the web UI answers on, and screenshot Interfaces > Assignments (IPs of LAN and of each VLAN).
3. Screenshot Firewall > Rules > LAN (and the rule list of the VLAN you use for management).
4. Tell me exactly what you changed when you "removed 127.0.0.1" (which page, which field).

The WireGuard kill switch, the DNS over the tunnel and the four VLANs come later, one at a time. The kill switch should be the very last step.

Sergio