Noob trying to get Wireguard working on vlans, Help!

[RoWAN Tree]

Hi I'm a noob trying this for the first time. I have been trying to get wireguard to work on a diy mini pc for over a month, I pay for internet but don't want to use the router they sent me so I bought the mini PC and installed opnsense.. I bought a TpLink TLSG108E managed switch and that been setup as well, my issue is that I can't connect to wireguard I put all the information in and try the DNS settings but I get lost because I don't understand everything, it locks me out then I have to reinstall and do everything again. Chatgpt sucks because it keeps freezing in the middle of setting this up every 20 mins. I was setting upDnsmasq Dhcp and lost access to web ui. I am having burnout with this and I haven't even got a working connection to the internet yet..  If someone can help me figure this out would be cool before I give up on Opnsense altogether thanks for anyone's time!

[BoNetTech]

Hi,

Don't give up yet. The usual way out is to go back to a simple setup and add one thing at a time, checking each step before the next:

1. Start with no VLANs at all: WAN on one port, LAN on another, the PC directly on the LAN port. Make sure you get an IP by DHCP and can browse the internet. For DNS, use only ONE service at the start (Unbound, which is the default) and leave the DHCP/DNS settings as they are out of the box.
2. Only then add the VLANs. On a TP-Link TL-SG108E remember it is not enough to put the port in a VLAN: you usually also need to set the PVID of the port. Keep one port untagged on the default VLAN as a safe way back into the web UI.
3. Only after that add WireGuard. WireGuard itself does not depend on VLANs, it needs a working WAN, a firewall rule that allows its UDP port on WAN, and a rule on the WireGuard interface.

To help you better it would be useful to know:
- What do you want WireGuard for: reaching your home network from outside, or sending your traffic through a VPN provider?
- Is your OPNsense behind the ISP router (double NAT) or directly on the internet?
- How many network ports does the mini PC have, and which one is WAN and which is LAN?
- Which OPNsense version are you running (System > Firmware)?

Also, a backup of config.xml (System > Configuration > Backups) before each big change means you never need to reinstall from scratch.

Sergio

[RoWAN Tree]

Hi, thanks for responding. I've been struggling to get opnsense working with wireguard on my vlans. I'm a beginner/ intermediate when it comes to networking and not a tech wizard as some others may be 😅 please keep that in mind. I used chat gpt to use opnsense documentation to make a step by step guide for set all this setup so I'm not sure its 100℅

I have a modem from ISP in bridge mode to the mini PC (WAN)re0 then mini PC (LAN)re1 to switch port 1. I've set up the pvids and vlans pages on the switch as was working before.

I was trying to do this whole setup offline then test the connection afterwards with wireguard. I have 4 vlans that I don't want talking to each other. Wireguard for everything in and out with quad9. I want to have no fallback to ISP once setup. I want the mgnt vlan to just be direct wired offline connection. I don't know how to do that though..

Port 1 default
Ports2,6- Vlan20 pvid20
Ports3,4,5 - Vlan10 pvid 10
Port7 - Vlan 30 pvid30
Port8 - vlan99 pvid99


Opnsense 26.7.8_2

I have setup the interfaces and assignments for vlans and wireguard, I have a handshake as well. The problem I think is dnsmasq dhcp. I dont know what I'm doing to be fair when it comes to this. I changed something on LAN removing a 127.0.0.1 and I lost access to the web ui.
The only way I can get back in is by the mini PC shell (pfctl -d), log back in then (pfctl -e) and it works, but once I close my browser it deletes cookies and data and won't load, keeps timing out, whereas before it didn't do that.

I've set up the ranges on DNS but I'm lost when it comes to the IPS and such. I can ping test 1.1.1.1 or 9.9.9.9 but I can't reach the web on any vlan.

Another thing is to make a floating rule on WAN with no egress tag for kill switch but when I click apply it disappears from floating rules and ends up under WAN rules, I'm not sure if that's supposed to do that or if its a bug..

I'm not sure what else you'd want to know but I can get into the nitty gritty if need be or if its better should I just restart and reinstall? Any help would be much appreciated

[BoNetTech]

Thanks for the details, that helps. I'd fix one thing at a time, and the first one is getting stable access to the web UI again. I suspect it is a firewall/interface issue and not dnsmasq: if it works after "pfctl -d", then "pfctl -e", and stops later, existing connections survive but new ones are blocked.

Please, before changing anything else:
1. Save a backup of config.xml if you can reach the GUI (System > Configuration > Backups).
2. From the PC on switch port 1, tell me which IP the web UI answers on, and screenshot Interfaces > Assignments (IPs of LAN and of each VLAN).
3. Screenshot Firewall > Rules > LAN (and the rule list of the VLAN you use for management).
4. Tell me exactly what you changed when you "removed 127.0.0.1" (which page, which field).

The WireGuard kill switch, the DNS over the tunnel and the four VLANs come later, one at a time. The kill switch should be the very last step.

Sergio

[RoWAN Tree]

OK that sounds good to me, I did this setup with ai and I'm not entirely sure it was helpful I'd prefer to learn this myself though. I'm not exactly sure where that 127.0.0.1 was removed from it was a few days ago..  Chatgpt kept freezing mid setup and wasn't signed up so i had to restart alot. I remember it was an option either in firewall rules when I made the killswitch or while I was doing DNS dhcp.. The default interface was LAN and the ai said to put the other networks instead  and I lost access after that.. I don't know what page it was on though..

Here are the screenshots you asked for, if you need anything else let me know.
.

[BoNetTech]

Thanks, the screenshots help. A few observations, but let's do one thing at a time:

You're reaching the GUI on 192.168.99.1 (MGNT99), so you're not locked out anymore, correct? Please back up config.xml now (System > Configuration > Backups) before changing anything else.
Interfaces > Assignments shows no IPv4 on LAN. Is that intentional (LAN only as parent for the VLANs), or did you remove it?
I don't see a rule allowing DNS (TCP/UDP 53) from XBOXS10, PERSONAL20 and GUEST30 to "This Firewall". If your clients use the firewall as DNS server, that traffic is blocked. Which DNS server do those VLANs get from DHCP?
The rule "KSWITCHENGAGE" on WAN looks like an inbound block rule. That is not a kill switch (WAN already blocks inbound). We can do the kill switch last.
About 127.0.0.1: please check System > Settings > General (DNS servers) and Services > Unbound DNS > General > Network Interfaces (Localhost should be selected) and tell me what you see.

Which problem is the most urgent for you right now: no DNS on the VLANs, or no traffic through Proton?

Sergio

[RoWAN Tree]

I can get into the web ui from vlan99 port 8 @ 192.168.99.1, but I have to enter the console first to do pfctl -d then -e to enable again but if say my laptop goes into sleep mode for a while when I try the web ui it doesn't open. Maybe a certificate thing?

I've saved a back up like you said to do, the reason for Assignments>LAN not having IP was chatgpt said to do set it to none to be able to put 192.168.99.1 on mgnt. I am a beginner so I don't know if that's the correct thing to do. My switch is set to 192.168.99.2, I wanted to be able to manage both opnsense and switch ui from vlan 99.

I originally had opnsense 26.7 which is why I used chatgpt because I couldn't update to the new version that I have now 26.7.8_2 the menu layouts and fixes were apparently different which was confusing and a reason why I'm lost with DNS.


For the DNS I got lost 😅 I installed Opnsense from a and was doing the setup but never actually connected to the internet yet only a handshake so far.. I don't know what the best setup would be for what I want..

The first time I tried the setup ai said use KEA DHCP and this time around DNsmasq dhcp. I know 0℅ about DNS and i couldn't say, I know that I was trying it with 9.9.9.9 quad9 but I got lost setting that up because everything else was messed up.. I got overwhelmed with stuff I don't know does what..

The kswitchengage was that floating rule that keeps going to WAN rules after clicking on apply when I make the rule on floating rules...

Here are some more screenshots, I think the unbound part you mentioned maybe what the ai said to change.. If that option is by default LAN the that's the one that was changed. Because mine has all the vlans.

Don't trust chatgpt seems to be the overall moral here 😅, in terms what's more important, just getting this set up properly. I don't want to use my ISP router, I want everything though the VPN and keep mgnt local, but if opnsense needs an update, how would that work offline, or is there another way to do that?

[RoWAN Tree]

Remaining screenshots ⬇️

[RoWAN Tree]

Only lets me upload 4 attachments at a time⬇️

[BoNetTech]

Thanks for the extra screenshots, they help a lot. The upload quality is low, so please correct me if I misread something.

A correction first: I earlier said your KSWITCHENGAGE rule looked like an inbound block. Now I see it is a floating rule on WAN, direction Out, Block, matching the local tag NO_WAN_EGRESS. That is a proper kill switch design. For it to work, your "via Proton" rules on the VLANs must set that tag ("Set local tag" in the rule, Internal tagging section). Can you check one of them and post a screenshot of that section?

Where I think things went wrong (one thing at a time):

DNS for the VLANs. I don't see any rule that allows DNS (TCP/UDP port 53) from XBOXS10, PERSONAL20 and GUEST30 to "This Firewall". MGNT99 only allows https to the firewall. If your clients get the firewall as DNS server via DHCP, their queries are dropped. As a first test, add on PERSONAL20 only: Pass, TCP/UDP, source PERSONAL20 net, destination "This Firewall", port 53, above the other rules. Then test DNS from a device on that VLAN. If it works, copy the rule to the other VLANs.
Unbound and 127.0.0.1. Under Services > Unbound DNS > General, Network Interfaces shows only GUEST30, MGNT99, PERSONAL20, XBOXS10. "Localhost" is not selected. That may be where 127.0.0.1 got lost: the firewall itself cannot use Unbound without it. Please don't change it yet, we'll come back to it after step 1.
VLAN IDs. On the switch you use VLAN 10, 20, 30, 99, and the port settings look consistent. In OPNsense the devices are named vlan01, vlan02, vlan03, vlan09. Please check under Interfaces > Devices > VLAN that the VLAN tags are really 10, 20, 30, 99 and the parent interface is the one connected to switch port 1.
Updates. Traffic from the firewall itself is not tagged NO_WAN_EGRESS, so the kill switch should not block it. But your system DNS servers are set to use the Proton gateway, so lookups (and update checks) go through the tunnel. If the tunnel is down, updates will fail. That is your choice: keep it if you want everything in the VPN, or leave the gateway empty for one DNS server if you want updates to work without the tunnel.

And about ChatGPT: you are right that setups built from partial advice are hard to untangle. Take a backup of config.xml now, and let's go step by step.

Sergio