Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Wireguard weird behavior

    WireGuard
    2
    4
    273
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      lcs
      last edited by lcs

      Hi,
      My current setup is :

      pfSense Site A (VPS) <=== WG TUN === > pfSense Site B (behind NAT)
      I can ping both sites from each fw.
      Rules are wide open. There's ANY rule on each interface tab, while the "Wireguard" interface group is empty with the following configuration done on both ends :
      1a299552-9fc1-4402-9628-05f3cf797d99-image.png

      Site A
      d31da2ec-9db8-454b-9390-e3b5766cf983-image.png

      Site B
      f9bfd0ce-6704-4ece-ad1e-7e0fe9372e6d-image.png

      IF Site A
      083dde46-d5b0-4e43-8805-bca78c799024-image.png

      IF Site B
      c304684f-e0d1-4b25-8e3d-24232e0e7748-image.png

      GW Site A
      66b91956-2173-4dea-91d0-9ba2402d98d2-image.png

      GW Site B
      b3b00541-f2b8-4871-8293-852233c1aa79-image.png

      Problem 1 : I get random IF IN/OUT errors on both ends. Even with the peers disabled, static routes disabled, GW monitoring disabled.
      Site A has ERR IN ; Site B has ERR OUT. Even after reboot of any of the FWs, as soon as I log in to the webui I see some ERRs
      Example :
      374ba04d-bb69-4c67-a7ac-9be7979f6c0e-image.png
      Sometimes the In\Out Bytes are 0 and the ERRs are rising.
      I tried playing with the MTU and MSS. Even with the default values of 1500 I don't see any fragmentation on packet cap. Currently it's set to 1420/1380 to see if there will be any change - so far no.

      How can I troubleshoot the cause of the errors when no traffic is passing through the tunnel ?

      Problem 2 : I'm using Site 1 as an entry point to some servies at Site B.
      Chain : Internet -> Site A -> WG tunnel -> Site B -> Traefik -> Service

      On Site A I have a static route
      ex. f55c9ddf-9ea1-4c3f-ac23-80ee49815d07-image.png

      NAT Rule
      b0057c98-f22a-4efc-b183-4cd4cf096d35-image.png

      When testing ports from public internet I can see hits on both FWs, but the result is port closed

      ex. Site A
      4ae311e9-7f0d-45eb-98ac-b897d17e2714-image.png

      Site B
      79d4354e-1886-44d2-a32f-9b9c694d7a13-image.png

      I have another NAT rule to pass 25 via another OpenVPN tunnel and it's working fine.
      But the port tested via the WG tunnel is not reachable.
      I can see the port open when testing from Site A FW via the WG interface but not from WAN.
      Another thing is, I don't see any kind of incomming requests to the traefik proxy. It's like the traffic is not reaching the proxy at all.

      Locally everything works

      Forgot to add something.
      On Site B when I do pcap on the WAN interface and filter for ex. 151.251.244.68 (a random IP from my cell) I get

      15:44:57.620779 IP 10.160.227.2.443 > 151.251.244.68.3325: tcp 0
      15:44:58.626336 IP 10.160.227.2.443 > 151.251.244.68.3325: tcp 0
      15:45:00.646200 IP 10.160.227.2.443 > 151.251.244.68.3325: tcp 0
      15:45:04.770288 IP 10.160.227.2.443 > 151.251.244.68.3325: tcp 0
      15:45:12.962319 IP 10.160.227.2.443 > 151.251.244.68.3325: tcp 0

      and the same from Site A

      15:47:33.625342 IP 151.251.244.68.3102 > 46.xx.xx.xx.443: tcp 0
      15:47:33.831357 IP 151.251.244.68.3103 > 46.xx.xx.xx..25: tcp 0
      15:47:33.863144 IP 46.xx.xx.xx..25 > 151.251.244.68.3103: tcp 0
      15:47:33.908237 IP 151.251.244.68.3103 > 46.xx.xx.xx..25: tcp 0
      15:47:33.908279 IP 151.251.244.68.3103 > 46.xx.xx.xx..25: tcp 0
      15:47:33.942517 IP 46.xx.xx.xx..25 > 151.251.244.68.3103: tcp 0
      15:47:34.017973 IP 46.xx.xx.xx...25 > 151.251.244.68.3103: tcp 40
      15:47:34.018294 IP 46.xx.xx.xx..25 > 151.251.244.68.3103: tcp 0
      15:47:34.072218 IP 151.251.244.68.3103 > 46.xx.xx.xx..25: tcp 0
      15:47:34.072251 IP 151.251.244.68.3103 > 46.xx.xx.xx.25: tcp 0

      Bob.DigB 1 Reply Last reply Reply Quote 0
      • Bob.DigB
        Bob.Dig LAYER 8 @lcs
        last edited by

        @lcs Maybe you can't have your Firewall Web-UI still on port 443. I always change it right at the beginning so I can't tell for sure.

        L 1 Reply Last reply Reply Quote 0
        • L
          lcs @Bob.Dig
          last edited by

          @Bob-Dig That's not the case.
          I tried to NAT to another random IP via the WG tunnel. for ex. random internal web server on port 80 and it is the same.

          1 Reply Last reply Reply Quote 0
          • L
            lcs
            last edited by lcs

            It turned out the traffic is reaching the rev proxy, but for some reason the packet is broken (maybe?)
            Attaching a pcap from the proxy cap.pcap

            1 Reply Last reply Reply Quote 0
            • First post
              Last post