@chudak Thanks. Updated and got it.

@dross The instruction regarding gateway automatically created is wrong. You have to add gateway manually.

For peer (the VPN provider side), the instruction is correct. The only address you need to input is the end point public address you obtain from the provider; and the allowed ips, which is usually 0.0.0.0/0

@nogbadthebad Thanks. I got it working with only a few steps, without any routing. Just create a new tunnel, new peer, new interface, and a new vpn gateway, based on setup config obtained from vpnunlimited. Then just create a firewall rule to allow, in my case, a whole subnet address to access all via the new vpn gateway. The chosen subnet belongs to one ssid I created just for Wireguard vpn connection.

I will write a more detailed instruction and post it here very soon.

Update: I've just posted my more detailed instruction here:
Instruction-WireGuard to VPN Provider only for a specific subnet

@bcruze pfsense forwarded 1.1.1.1 by itself. i tired regeneration, no luck.

edit: no pihole... I think it forwarded 1.1.1.1 because I have forward dns servers checked.

A small mistake on my part. Changed the subnet from /32 to /24
254e828c-e599-41fe-878d-76442129949d-image.png

Now it´s working again :)

@chudak

I have the same problem. pfsense WG slow than ubuntu system WG

@dcgibby said in Cannot connect from tun_wg0 to LAN:

@dkeller
The current WG package doesn’t setup any routes.
So for the peers you create in pfsense, the allowed ips need static routes created.
Also you are going to have to check outbound NAT and set to manual and remove any NATing on your WG gateway.

Create the tun_wg0 interface
static ipv4
10.1.1.1/24
none for gateway

Then go to system -> routing
create a new gateway
using the assigned opt interface for the tun_wg0 (or whatever you name it)
set gateway to 10.1.1.2

Now goto system->routing->static routes
create a new static route
10.1.1.2/32
using the gateway you created above

Then you need to goto firewall->nat->outbound
set to manual
remove any of the assigned opt interface
remove any NATing of 10.1.1.1/24 on the assigned opt interface

also if you need to access pfsense dns you have to setup that on your client. you can use the opt interface address and just make sure it’s enabled in dns resolver

give that a try and see if connections work.

for the 0.0.0.0/0 access
you have to do the above but create a second gateway with address the one of client 10.1.1.3
then add static route to that ip

then you need to setup outbound NAT
Use WAN
source 10.1.1.3/32 (or 10.1.1.0/24 if you want all clients to route through wan)
NAT address set to WAN address

again make sure you have DNS setup on client to resolve things. either point to your pfsense box or some other DNS server

I'll give it a go and see. Is it me or the primary purpose of vpn is to go from client to server anyway, would you focus on that part first with a package?

@bigsy

FYI https://redmine.pfsense.org/issues/12175 - needs clean up

@brookheather said in WireGuard Package documentation:

Then you need to assign this interface a static IPv4 address range (your peers will be using an IP within this range).

I registered just to post here. This was it. This fixed my WireGuard issue. I could get connections and handshakes to the tunnel, but I couldn't get LAN or WAN access.

I do not remember if I had the configured in 2.5.1 or not, but since the change to 2.5.2 I couldn't get the WG tunnel to pass traffic. I didn't even need to create a gateway for the tunnel as mentioned above.

Adding the IP address fixed it all. Thank you!