OPNsense + AirVPN (WireGuard): How to configure port forwarding

[SenseX]

Why is it so incredibly difficult to get port forwarding working through a VPN on OPNsense?
I'm using AirVPN and have configured WireGuard. The connection is established, and I have a successful handshake.
Policy-based routing is also working correctly when I connect my computer to the dedicated VLAN.
However, I simply cannot get port forwarding to work. I have already configured the port forwarding on the AirVPN side, and my goal is to run Plex through the VPN.
I've done this before with pfSense without any issues. However, after migrating to OPNsense, I eventually gave up trying to get it working. Now I'd like to give it another shot.
Could someone please explain, step by step, how to configure this properly in OPNsense?
To make things easier, let's use the following example:

• Plex server local IP:
  
  Code Select Expand
  10.20.30.40
• Plex internal port:
  
  Code Select Expand
  32400
• AirVPN forwarded port:
  
  Code Select Expand
  45678
• AirVPN gateway:
  
  Code Select Expand
  AirVPN_GW

What I'm trying to achieve is to access my Plex server through the AirVPN public IP using port

Code Select Expand

45678, with traffic forwarded through the WireGuard tunnel to my local Plex server on

Code Select Expand

10.20.30.40:32400.
I'd really appreciate a clear explanation of which NAT rules, firewall rules, and routing settings are required, and how they should be configured to make this work.
Thanks in advance!

[BoNetTech]

Port forwarding through a VPN on OPNsense usually fails in one of three places. Let's check them in order, so you can see where the packets stop:

1. Does the traffic arrive at all?
From a machine OUTSIDE your network (e.g. phone on mobile data, not the LAN – NAT reflection would confuse the test), try to reach the AirVPN IP on port 45678. At the same time open Firewall > Log Files > Live View and filter on destination port 45678.
– Nothing shows up: the problem is on the AirVPN side. Check in their client area that the port is TCP, assigned to your account, and forwarded to IPv4.
– It shows up as blocked: go to step 2.
– It shows up as passed: go to step 3.

2. Port forward and firewall rule (Firewall > NAT > Port Forward)
– Interface: the AirVPN WireGuard interface (the one the traffic arrives on, not the Plex VLAN).
– Protocol: TCP. Destination: the interface address of the AirVPN interface (or "any"). Destination port: 45678.
– Redirect target IP: 10.20.30.40, target port: 32400.
– Filter rule association: "Add associated filter rule" (or create the pass rule yourself on the AirVPN interface: TCP, destination 10.20.30.40, port 32400).

3. Replies must go back through the tunnel, not out the WAN
The Plex VLAN has a policy-routing rule with AirVPN_GW, which is good for outgoing traffic. For replies, check that the rule created in step 2 does not have "disable reply-to" set, and that the WireGuard interface has its gateway assigned (System > Gateways). Packet capture (Interfaces > Diagnostics > Packet Capture) on the WireGuard interface and on the Plex VLAN, port 45678 / 32400, shows whether the replies leave through the wrong interface.

Also: outbound NAT for the Plex VLAN through the AirVPN interface must be in place (Firewall > NAT > Outbound), otherwise the Plex server cannot reach the Internet through the tunnel.

If it still fails, please post: (a) a screenshot of your NAT port forward rule, (b) the Live View lines for port 45678, (c) the result of a packet capture on the WireGuard interface.

Sergio

[SenseX]

Hi,

Thank you for pointing me in the right direction!
After a few hours of troubleshooting, I finally managed to get it working.
It turns out that the issue was that I needed to add the AirVPN gateway to the AirVPN firewall rule using the Reply-to option.
The solution was simply to set:
Reply-to:

Code Select Expand

AirVPN_GWEverything is now working as expected!

Thanks again for your help!

[BoNetTech]

Great 👍