@mahla Hi, your client side (192.168.232.2) doesn't now the route back to your pfsense LAN: 192.168.201.1/24. your have to add on client site: route add -net 192.168.201.1/24 gw 192.168.232.1

@itBJA Hello, it's a standard rule to block: pfctl -vvsr |grep 1000000101 @6 block drop in quick inet from 169.254.0.0/16 to any label "Block IPv4 link-local" ridentifier 1000000101

@lvrmsc said in The service show not running but client can connect to wireguard server.: Same here. It started after I installed 25.07. Same here too, came from fresh 2.8.1 installation and restored 2.7.2 config. The other topic I had opened before finding this: https://forum.netgate.com/topic/198449/25.07-release-amd64-wireguard-service-reported-stopped-yet-tunnel-trafic-clearly-is-ok (checked, have Watchdog Service disabled temporarily too) My wg_0 worked directly after reboot, wg_1 takes some minutes to established, but Wireguard Service marked as stopped (red) all the time. Some static routes defined on pfsense for wg_1 interface with gateway on the remote side, but still missing in system routing table after wg_1 established (ex.): ... php_wg[24929]: /usr/local/pkg/wireguard/includes/wg_service.inc: Static Routes: Gateway IP could not be found for 10.0.30.0/24 ... Therefore wg_1 isn't usable regarding related routes are missing. My work around currently: Disabling Peer assigned to wg_1 by GUI --> pfsense means (by error message) Wireguard not running ;-) and disables wg_0 related Peer too and Wireguard Service stopped in real --> Re-enable wg_1 related Peer --> Start Wireguard Service via GUI and it goes to green --> form now on all wg_1 related routes are in the routing table It seems behavior could routing table related because the error messages (above) starts at boot time before Wireguard Service is started... What is the situation on your sides? (Will check the situation with temporarily disabled static routes before next reboot)

@Bob.Dig I will work on some pics but it's been in a state of evolution as a test network running another scenario at the moment - but when I can switch it back to this I was looking for some things to focus on and try. I used an interface group for NAT rules because one of the tutorials I read showed to do that and said create a group or do rules for every one. Seemed like a group would be best practice then for larger numbers - but you you recommend to just do a NAT entry for each instead?

@hfederau good manual to recheck setup -> https://www.wundertech.net/how-to-set-up-tailscale-on-pfsense/

This was a great post to get me started with a dual VPN solution - thanks so much for the write up @LaUs3r . For my use case I desire a wireguard primary interface and a failover wireguard connection if primary goes down or has high latency. I finally got both set up, handshaking and passing traffic. I'm probably a bit over my head here and did a lot of trial and error to get things going so sorry if stupid question but once thing still isn't working for me correctly. wg0 and wg1 are both passing traffic like a round robin load balance situation - each successive connection alternates which one is being used - but that isn't the behavior I want. I want to only send traffic to wg1 if wg0 fails (or gets high letency and packet loss). I created a gateway for each and a gateway group. In the gw group I have wg0 as Tier 1 and wg1 as Tier 2 but they seem to be treated equal. I also created an interface group for my NAT rules that contains VPN1(wg0) and VPN2(wg1) I think I am missing what rules/process steers the traffic to the gateway group and how the NAT works and maybe somehow I'm sending traffic to both gateways ignoring the group tier and priority. Any ideas where I should look in more detail to figure this out? TIA

@powerguy42 how?

resolved! Issue was the following I corrected a few things on your config: Your Outbound NAT configuration was malformed. I corrected it to utilize Hybrid mode and configured a single Outbound NAT for your Wireguard connection, which should be much cleaner. I updated your routing table to be Automatic and switched to Policy-based routing within the firewall rules under Firewall --> Rules --> LAN I updated the name of the interface for the Wireguard tunnel to be called TORGUARD and set the MSS clamping to 1350. This can probably be bumped back up to 1400, but I wanted to make sure the clamping was small enough to avoid fragmentation. I cleaned up some redundant firewall rules and a few other "odds and ends".

@HFADmin If it is no Site2Site-VPN then you don't need any gateways in the first place... If that is true but you want to monitor the connection then you could create dummy-gateways just to ping the remote ip-addresses.

@Bob.Dig what's the right place?

This is what I observe in the system logs when this event occurs: not letting me post the logs here due to ant spam filter you can see it on my post on reddit here in the reply's: https://www.reddit.com/r/PFSENSE/comments/1mrqwg3/wireguard_tunnel_disconnectreconnect_events_cause/

I took some days before reporting again... Since then I installed: 25.07.1-RELEASE (amd64) built on Fri Aug 15 20:42:00 CEST 2025, and the issue re-appeared but did not (yet) clear by itself. Wireguard works well, that system has only one tunnel with another site, using interface assigned mode. I depend on it, and it works flawlessly. Yet the wireguard configuration page, its status page as well as the services widget on the dashboard, all report the Wireguard service as stopped, with the usual icon to start it. On the dashboard the gateways widget shows Pending for the IPv4 and IPv6 wireguard gateways. On the other hand, and it is logical as the packets do flow through the tunnel, the Wireguard widget on the dashboard shows the tunnel up with traffic. To be complete, the watchdog service, if wireguard is configured there, spend its life at detecting wireguard stopped and attempting to start it, which does not work. The other side of the tunnel is still on 25.07-RELEASE (amd64). I'm reluctant to upgrade that side too, with fear to loose the wireguard tunnel altogether. Aren't there any logs from that wireguard package? I can't find anything of that kind.

I figured out the issue. I missed adding the 3rd locations Lan to the static routing. Now all is working perfect.

@Gertjan Hello, I installed the official app of vpn #1 on the crappy laptop but on the main laptop I did not install official app of vpn #2, I used it via wireguard. I am not worried about vpn #1 provider and how much they know about me. They already have my ip address since I connect to them direct. My goal is to hide from vpn #2. I don't want them to know I am the same person who used this service before. and thanks for the heads up regarding windows. I had a feeling that would come up. I know windows is spyware but for my purposes it doesn't matter since I really just need to make sure vpn #2 doesn't know this user is the same user who signed up last year. (ok yes I know, how do you know vpn #1 or #2 are not owned by ms? I agree, you dont know)

@boyan1 said in Wireguard Gateway not coming up after reboot.: W Hey man, im trying to make the SITE A use internet of SITE B as you did, but there is no means of making that works. How did you make that works? Could you tell me please? Thanks!

@mreardon said in Wireguard Tunnels - Gateway Recovery Behaviour intermitent: This is still an issue as of 2.8.0 / 25.07, and it drives me crazy. Gateway failure works as expected, the wireguard tunnels will fail over to the backup gateway and continue on as normal, but will never recover once the failed gateway comes back online. While a reboot will (usually) fix it, I usually just go into my routing settings and mark the secondary gateway as down, forcing it to revert back to the primary... the users tend to dislike it when I reboot the firewall in the middle of the day Thanks for adding to the post - genuinely seems to be an issue, unsure if it's a Wireguard implementation problem or a pfSense issue at this stage though. I don't know if anyone else has noticed, but it seems even worse on 25.07. I've got my Wireguard VPN's set as tiered, but pfsense is now pretty much ignoring those tiers in the failover group and firing traffic over whatever one it fancies. Nothing has changed in my setup. Same failover group, same rules pointing traffic at the failover group with the appropriate tiers set - but the tiers don't seem to make any odds. I've recreated the failover group too. I've gone back to 24.11 and it works fine there, so I'll stick on this one for a while I think.

SOLVED. Turns out nothing wrong with my tunnel setup and not due to CGNAT. The reason PING works and other traffic doesn't is due to packet size and MTU. Something on the wireless network means that the default MTU doesn't work, forcing a smaller MTU to 1280 on pfSenseB fixed this. This Reddit thread has more details of this issue: https://www.reddit.com/r/WireGuard/comments/qmsa2n/ping_works_but_sites_arent_loading/

Hi again, to be honest: I guess, I did not remember exactly what I did 2 years ago. May I was mistaken by the interface name opt2 because the SG-3100 has a physical port OPT1 and I mixed up physical and virtual names. The goal was to use 2 different tunnels, one for the mobile clients and one for the site-2-site connection. And now all is running in that way . Regards