@chpalmer One of us should post this to redmine as a regression. Just done by me. Ted

Found a solution: When using the desired outbound address in the outbound nat rule for translation directly, instead of using an alias ip, it seems to work as desired.

Yeah, I'm dumb. The tunnel CID was /29. I just read that only 6 IPs are possible with /29. After I changed the tunnel network to /28, everything works as desired. Well, maybe it will help someone else. Gosh, I'm so embarrassed. XD

@Bronko Thank you very much. I tried adding a route to the device server - unfortunately it wont let me set static routes on tunnel interfaces - but I contacted the manufacturer here and hope he has a solution. I will keep this thread updated and let you know of the outcome

@Bronko The command output of pfctl -vvsr | grep 100000101 is: @2 block drop in log inet all label "Default deny rule IPv4" ridentifier 1000000101 But as I have a rule above saying allow any, this shouldn't happen!

@Bob.Dig I will work on some pics but it's been in a state of evolution as a test network running another scenario at the moment - but when I can switch it back to this I was looking for some things to focus on and try. I used an interface group for NAT rules because one of the tutorials I read showed to do that and said create a group or do rules for every one. Seemed like a group would be best practice then for larger numbers - but you you recommend to just do a NAT entry for each instead?

@hfederau good manual to recheck setup -> https://www.wundertech.net/how-to-set-up-tailscale-on-pfsense/

This was a great post to get me started with a dual VPN solution - thanks so much for the write up @LaUs3r . For my use case I desire a wireguard primary interface and a failover wireguard connection if primary goes down or has high latency. I finally got both set up, handshaking and passing traffic. I'm probably a bit over my head here and did a lot of trial and error to get things going so sorry if stupid question but once thing still isn't working for me correctly. wg0 and wg1 are both passing traffic like a round robin load balance situation - each successive connection alternates which one is being used - but that isn't the behavior I want. I want to only send traffic to wg1 if wg0 fails (or gets high letency and packet loss). I created a gateway for each and a gateway group. In the gw group I have wg0 as Tier 1 and wg1 as Tier 2 but they seem to be treated equal. I also created an interface group for my NAT rules that contains VPN1(wg0) and VPN2(wg1) I think I am missing what rules/process steers the traffic to the gateway group and how the NAT works and maybe somehow I'm sending traffic to both gateways ignoring the group tier and priority. Any ideas where I should look in more detail to figure this out? TIA

@powerguy42 how?

resolved! Issue was the following I corrected a few things on your config: Your Outbound NAT configuration was malformed. I corrected it to utilize Hybrid mode and configured a single Outbound NAT for your Wireguard connection, which should be much cleaner. I updated your routing table to be Automatic and switched to Policy-based routing within the firewall rules under Firewall --> Rules --> LAN I updated the name of the interface for the Wireguard tunnel to be called TORGUARD and set the MSS clamping to 1350. This can probably be bumped back up to 1400, but I wanted to make sure the clamping was small enough to avoid fragmentation. I cleaned up some redundant firewall rules and a few other "odds and ends".

@HFADmin If it is no Site2Site-VPN then you don't need any gateways in the first place... If that is true but you want to monitor the connection then you could create dummy-gateways just to ping the remote ip-addresses.

@Bob.Dig what's the right place?

This is what I observe in the system logs when this event occurs: not letting me post the logs here due to ant spam filter you can see it on my post on reddit here in the reply's: https://www.reddit.com/r/PFSENSE/comments/1mrqwg3/wireguard_tunnel_disconnectreconnect_events_cause/

I took some days before reporting again... Since then I installed: 25.07.1-RELEASE (amd64) built on Fri Aug 15 20:42:00 CEST 2025, and the issue re-appeared but did not (yet) clear by itself. Wireguard works well, that system has only one tunnel with another site, using interface assigned mode. I depend on it, and it works flawlessly. Yet the wireguard configuration page, its status page as well as the services widget on the dashboard, all report the Wireguard service as stopped, with the usual icon to start it. On the dashboard the gateways widget shows Pending for the IPv4 and IPv6 wireguard gateways. On the other hand, and it is logical as the packets do flow through the tunnel, the Wireguard widget on the dashboard shows the tunnel up with traffic. To be complete, the watchdog service, if wireguard is configured there, spend its life at detecting wireguard stopped and attempting to start it, which does not work. The other side of the tunnel is still on 25.07-RELEASE (amd64). I'm reluctant to upgrade that side too, with fear to loose the wireguard tunnel altogether. Aren't there any logs from that wireguard package? I can't find anything of that kind.

I figured out the issue. I missed adding the 3rd locations Lan to the static routing. Now all is working perfect.

@Gertjan Hello, I installed the official app of vpn #1 on the crappy laptop but on the main laptop I did not install official app of vpn #2, I used it via wireguard. I am not worried about vpn #1 provider and how much they know about me. They already have my ip address since I connect to them direct. My goal is to hide from vpn #2. I don't want them to know I am the same person who used this service before. and thanks for the heads up regarding windows. I had a feeling that would come up. I know windows is spyware but for my purposes it doesn't matter since I really just need to make sure vpn #2 doesn't know this user is the same user who signed up last year. (ok yes I know, how do you know vpn #1 or #2 are not owned by ms? I agree, you dont know)