Wireguard Site to Site
-
Re: Wireguard Site-to-Site Setup - Errors on Interface
I am setting up a Wireguard site to site between two pfSense (2.6.0) before sending the one off. I followed the video from Christian MacDonald here: https://youtu.be/2oe7rTMFmqc to set it all up (tunnels, peers, firewall, interface, gateway routes, etc).
Unlike the video, I have the "new" equipment WAN linked to my LAN for setup. I am not sure if this affects how it works. I have been sticking to IP addresses to rule out DNS. Routing tables look fine.
Both pfSenses show the tunnel gateway up and good connection. However, the Wireguard itself is not functional. Example, unable to connect to the new equipment LAN (to access WebGUI) from my LAN. Tracert from my pfSense shows the first hop at the Wireguard tunnel IP but after that is all *.
I have checked the settings across both devices multiple times and the video. Not sure what else to look for. I wish there was some kind of log for Wireguard connections.
I do see interface errors, both in and out. My pfSense shows:
Packets In 26451
Packets Out 66561
Bytes In 749 KiB
Bytes Out 1.84 MiB
Errors In 40287
Errors Out 10028None of the other interfaces (physical and VLANs) have errors. Only the Wireguard S2S one. The "new" pfSense barely has any errors (0 in, 51 out) for (39166 in, 105932 out) on the S2S interface.
Searching the States for the Wireguard port shows only ipv6 entries (both pfSense). Strange considering the Wireguard networks, routing, and S2S interface are only set to use ipv4 (Firewall rules allowing combinations of ipv4 and ipv6 have no effect). Any ideas?
At this point, seems I will do 1 more pass checking each setting carefully. And then hope it works when both are separated by the internet.
-
@random_pawn
What does "WAN linked to LAN" mean?Post pics of Wireguard config, interfaces, static routes, gateways, everything you did.
-
Sounds more like a problem of your test setup and not something with WireGuard.
-
@jarhead The video shows both pfSense connected to a WAN. My network isn't set up like this. My network pfSense WAN is connected to the ISP while the one for remote is being configured with its WAN connected to my LAN.
-
@bob-dig Any ideas what to look at? I have spent hours looking at the settings in that video. The gateway monitor on each side sees the other one.
-
@random_pawn said in Wireguard Site to Site:
@jarhead The video shows both pfSense connected to a WAN. My network isn't set up like this. My network pfSense WAN is connected to the ISP while the one for remote is being configured with its WAN connected to my LAN.
First, as I said. Post pics of the config. Another set of eyes will probably help.
Second, you need to be more clear about this wan-lan link.
Draw a picture of what you mean, because from what you're saying, the remote site connected to your lan wouldn't make it remote. That makes no sense.
Are you saying the remote is a lab setup in your home? -
I am configuring this device for deployment. Sorry I was not clear on that point. That is why the WAN is connected to my LAN. This device will be going over a thousand miles away and I need to set it up before it makes that journey. All of this headache just so I can remotely help (and make my life a little easier without needing to coordinate some kind of remote desktop/access). And this scenario requires the remote device to punch the hole through because their ISP uses private IPs, so the link will rely on the remote device establishing the link.
I have isolated it to the Firewall blocking the access. The default deny rule was stepping in to block it. The Firewall knows it is the S2S interface... and not the WAN. Private IP restrictions do not apply. The Default deny rule on both firewalls was blocking access. Oddly, the PC on the remote pfSense had no issues accessing my pfSense WebGUI but could not access my LAN devices... and I could not go the other direction to access the WebGUI of the remote device..
I need to review the syntax/scope on the Firewall rules again. By default, pfSense uses XXX net for Source. I had copied the allow rules to the S2S interface and updated to use S2S net. As Christian's video shows in the Firewall section, source is set to * (All). I have the tunnel working now. So sorry about wasting anyone's time.
P.S. Akismet is flagging my post as spam. Not sure why that is. Apparently it won't allow me to add images with the post.
