Wireguard gateway no working outside dashboard

technoblue

The tracert comand fail as the gateway doesn`t route it

I only have the config of the peer of pfsense as the other device is a qnap router and in that side i can´t see the peer config, but i think that if in the pfsense dashboard the ping works it have to be something in the gateway config or static routes...

Pfsense peer config:

Firewall rules MYSWITCH

LAN Config:

MYSWITCH Config:

technoblue

Traceroute working

But when I select the interface MYSWITCH (this is what i use as i use my 3 LAN ports)

technoblue

Someone know what cloud be happening?

Jarhead

@technoblue Judging by your Firewall Rules I'd assume you're not using an interface for the tunnel so what rules do you have on the Wireguard tab?

technoblue

@Jarhead

Hi! Yes I´m using an interface

What I don´t understand is why the ping works with the LAN interface, but it doesn´t works with the "MYSWITCH" interface, this one I use to have 3 LAN ports of my box

Jarhead

@technoblue You need to set the MTU to 1420 on the WG interface.
Do a constant ping from the far end while doing a packet capture on the pfSense WG interface. do you see the pings going both ways?

technoblue

@Jarhead

MTU to 1420, done.

No, my other wireguard service is running in an Qnap router and it doesn´t allow me to use the wireguard as cllient, only server I think it doesn´t matter as I can reach the subnet 192.168.15.0/24 the Qnap LAN, the ping and trace rout works when in Pfsense i select LAN interface, the problem is when I want to reach it from my Bridge interface (MySwitch) which is the one i use.

Jarhead

@technoblue So then it's something on the pc itself.
Is the gateway set correctly?
Do you have Windows firewall enabled? If so, disable it.
Is the pc's network discovered as public or private?
Can the pc connect to anything else?

Just to clarify, Wireguard doesn't use Server/Client types. Everything is just a peer.
Although one peer can be used as a hub in a hub and spoke config (ie multisite) so it can be considered a server, but it's still just a peer.

technoblue

@Jarhead

My Pc and my other devices in the network doesn`t have any issues, I think that the gateway is set correctly because in the ping and tracerout test works fine with "Any" or LAN Interfaces, the issue is when I try it with the "MYSWITCH" bridge interface (which is the one use)

Static Route:

Thanks for the clarification.

technoblue

Some idea? Someone?

technoblue

Finally!

The solution was creating a firewall rule that route the traffic of my Bridge interface through the gateway i have created for the wireguard client.