WireGuard site-to-site pfsense-to-pfsense no handshake?
-
That’s for the tutorial. I was following a German dude tutorial on YouTube and setting gateways for site 1 the site 1 ip and for site 2 the site 2 up. Result was losing handshake and pings after a few hours or randomly. Even with keep alive settings.
For now I reverted back to IPSec for site to site vpn as is more stable and easy to setup. Manual creation of static routes and gateways it’s as bit of pain if you’re on relatively big environment.
I know, I know… it’s experimental. Works great for mobile warriors though.
-
This was working fine on version 0.1.3. Updated to 0.1.5 and now I cannot access any of my peers subnet defined in static routing. I can ping from pfsense but pinging from any address on the lan subnet doesn’t work. Site one can’t ping site 2 and vice versa.
-
With hybrid nat the automatic nat rules for the WG interface look like a hot mess, especially if you have multiple interfaces. Anyone have examples of what it should look like?
-
What is your goal with the Outbound NAT change? It is not required for site-to-site.
If the goal is to change all traffic to the interface ip you can do that by setting to roules:
Interface: WG interface
Source: 127.0.0.0/8
Source port: *
Destination: * or what you need
Destination port: *
NAT Address WG address
NAT port: *
Static port: falseInterface: WG interface
Source: <Your LAN ip
Source port: *
Destination: * or what you need
Destination port: *
NAT Address WG address
NAT port: *
Static port: falseNot sure if this is what you are looking for?
-
After much hair pulling I finally made this work and stable.
You need to specify / create and assign he gateway to the WG Interface when you create it else you'll have or sort of routing issues
You also need to create static routes to the gateway with the subnets you want to access on the other side of the tunnel.Oh and the instructions above are wrong the Gateway ip needs to be the ip of tunnel on your side and not on the opposite side or it won't work.
Unfortunately then entire wireguard project seems to be quite secondary at this point for negate (they didn't even bothered updating the documents)... I know it's still experimental, but ok...
The developer is also never available never replies to anything in any of the platforms he mentions on his videos. He just ignores 99% of problems people are having (I hope they are not expecting us to start opening pointless stuff on redmi) -
Hi the use of the Gateway ip from the other side is not wrong, you do that with OpenVPN site to site as well when using layer 2 (TAP interface) and it give you the correct ping to the other side, and it helps keep the connection/session alive.
You do not need to do any NAT config if you follow the above.
Just remember to set the
MTU: 1420 and
MSS: 1420
That fix most problems. -
there is also a bug here that causes no handshake.
https://forum.netgate.com/topic/167279/wireguard-won-t-handshake-package-bug?_=1634581891833 -
This bug should be resolved in the latest version (0.1.5_2 and above). This package is available CE 2.5.2/2.6.0 and Plus 21.05.2/22.01. Give it a shot :)
-
@cmcdonald I don’t see any 0.1.5_2 update on my end
-
@bassopt hmmm, will check the builds. Thanks for checking
-
@bassopt Take another peak now, updated package should be available.
