Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Wireguard is not routing any traffic

    Scheduled Pinned Locked Moved WireGuard
    44 Posts 6 Posters 10.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • ?
      A Former User
      last edited by

      I have set up a Wireguard connection to Surfshark in pfsense and assigned an interface to it. The status page says that the handshaks had happened and the Gateway is green in the status page. I also added NAT rules for the new interface and a firewall rule to send the traffic through the gateway. But my clients can't sent any traffic out.

      Do I need to add allow rules to the Wireguard firewall tab? Do I need to add some static routes?

      ? Bob.DigB 2 Replies Last reply Reply Quote 0
      • ?
        A Former User @A Former User
        last edited by

        @thisisme according to the pfsense documentation I have to add a firewall to the Wireguard tab that pass any traffic (any destination, any source) but wouldn't this mean that all incoming traffic from the Internet can access my lan? Including unwanted malicious connections?

        G 1 Reply Last reply Reply Quote 0
        • G
          gabacho4 Rebel Alliance @A Former User
          last edited by

          @thisisme no that rule is for your network through the interface to the world. You gotta ask yourself, would Netgate really provide configuration guidance that would hurt its customers and reputation as a security-minded company? You’ll never pass any traffic if you don’t have an allow rule.

          ? 1 Reply Last reply Reply Quote 0
          • G
            gabacho4 Rebel Alliance
            last edited by gabacho4

            If it makes you feel better you could specify your lan subnet as the originator. The config guides are meant to cover the basics. You then can tighten things up to your heart’s content with the understanding that mucking around without understanding what you’re doing can result in bad things.

            1 Reply Last reply Reply Quote 0
            • Bob.DigB
              Bob.Dig LAYER 8 @A Former User
              last edited by

              @thisisme said in Wireguard is not routing any traffic:

              I have set up a Wireguard connection to Surfshark in pfsense

              How?

              1 Reply Last reply Reply Quote 0
              • ?
                A Former User
                last edited by

                That's my setup
                4.png 3.png 2.png 1.png

                and this is the config provided by surfshark

                [Interface]
                Address = 10.14.0.2/16
                PrivateKey = <insert_your_private_key_here>
                DNS = 162.252.172.57, 149.154.159.92
                [Peer]
                PublicKey = fJD***********
                AllowedIPs = 0.0.0.0/0
                Endpoint = de-fra.prod.surfshark.com:51820
                

                I also added a Firewall-Rule to my LAN interface targeting the Gateway NORDVPN1_VPNV4 which is assigned to the interface NORDVPN1 (don't mind the name, I moved from nordvpn last week)

                ? 1 Reply Last reply Reply Quote 1
                • ?
                  A Former User @A Former User
                  last edited by A Former User

                  I wonder if it's correct to use '10.14.0.2' as the ip address of my interface, but the pfsense documentation says I should put an IP there and it's the only one I have. (DHCP is not working)

                  I can ping server on the internet from my own clients, but higher traffic is not passing

                  Bob.DigB 1 Reply Last reply Reply Quote 0
                  • Bob.DigB
                    Bob.Dig LAYER 8 @A Former User
                    last edited by Bob.Dig

                    @thisisme I will be looking into this for myself shortly. 😉

                    1 Reply Last reply Reply Quote 0
                    • ?
                      A Former User @gabacho4
                      last edited by

                      @gabacho4 said in Wireguard is not routing any traffic:

                      no that rule is for your network through the interface to the world

                      I'm still confused. I thought that rules are evaluated when they enter the interface. Traffic from LAN should not enter the Wireguard interface, but traffic from outside. Right?

                      Bob.DigB 1 Reply Last reply Reply Quote 0
                      • Bob.DigB
                        Bob.Dig LAYER 8 @A Former User
                        last edited by Bob.Dig

                        @thisisme said in Wireguard is not routing any traffic:

                        Right?

                        Right, don't put any rule on that interface.

                        ? 1 Reply Last reply Reply Quote 0
                        • ?
                          A Former User @Bob.Dig
                          last edited by

                          @bob-dig I found the problem I had to set the MSS on the wireguard interface, but I remain with another problem:

                          I can't route DNS through wireguard
                          If I select the the old OpenVPN interface the DNS resolver is working, but with the new Wireguard interface I can't resolve anything. Any idea? DNS is 9.9.9.9

                          Bob.DigB 1 Reply Last reply Reply Quote 1
                          • Bob.DigB
                            Bob.Dig LAYER 8 @A Former User
                            last edited by

                            @thisisme I am trying right now and for me it is also not working. It is new for them too, maybe they have problems on their side.
                            Will report here if this changes for me.

                            ? 1 Reply Last reply Reply Quote 0
                            • ?
                              A Former User @Bob.Dig
                              last edited by

                              Just to point it out: I don't had to add firewall rules to the Wireguard tab. This advice is WRONG and DANGEROUS

                              Bob.DigB 1 Reply Last reply Reply Quote 0
                              • Bob.DigB
                                Bob.Dig LAYER 8 @A Former User
                                last edited by Bob.Dig

                                @thisisme Ping and DNS seem to be working for me. I didn't tested DNS within pfSense but just in a Windows VM. But I can't surf anything.

                                ? 1 Reply Last reply Reply Quote 0
                                • ?
                                  A Former User @Bob.Dig
                                  last edited by

                                  @bob-dig have you set the MSS on the Wireguard interface?

                                  Bob.DigB 1 Reply Last reply Reply Quote 1
                                  • Bob.DigB
                                    Bob.Dig LAYER 8 @A Former User
                                    last edited by Bob.Dig

                                    @thisisme No, I don't think it is a must anyways.

                                    ? 1 Reply Last reply Reply Quote 0
                                    • ?
                                      A Former User @Bob.Dig
                                      last edited by

                                      @bob-dig for me it don't work without it

                                      Bob.DigB 1 Reply Last reply Reply Quote 1
                                      • Bob.DigB
                                        Bob.Dig LAYER 8 @A Former User
                                        last edited by

                                        @thisisme So which size should it be?

                                        ? 1 Reply Last reply Reply Quote 0
                                        • ?
                                          A Former User @Bob.Dig
                                          last edited by

                                          @bob-dig 1412 seems to work. Maybe you have to play a bit

                                          ? 1 Reply Last reply Reply Quote 0
                                          • ?
                                            A Former User @A Former User
                                            last edited by

                                            Solved my DNS problem. Looks like wireguard is not adding any routes. I had to add a manual one for the DNS-Address and the gateway

                                            Bob.DigB 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.