Site-to-Site Route is One-way
-
Hello,
I followed the Netgate guide for a Site-to-Site tunnel (https://docs.netgate.com/pfsense/en/latest/recipes/wireguard-s2s.html), and have created a successful connection. This connection is setup the same, just with different network addresses (two PfSense firewalls).
HQ LAN: 172.16.0.0/22
Satellite LAN: 10.1.1.0/24HQ VPN: 10.100.100.0/31
Satellite VPN: 10.100.100.1/31Static routes are configured in each PfSense, with the gateway being the VPN address of the other. Each Wireguard interface has an any-any rule. LAN firewall rules are also any-any on both sides.
I have verified that both the HQ and Satellite networks are able to contact the VPN addresses of both firewalls. Standard networking also works perfectly, each LAN is still using the proper default gateway and resolves DNS.
The HQ LAN is able to perfectly communicate with any device on the Satellite LAN, Tested comms are SSH, ICMP, and HTTP/S, all reply back to the host on the HQ LAN.The problem comes in when trying to communicate from the Satellite LAN to the HQ LAN. The Satellite firewall always gives a "Destination Unreachable" reply. I tested pinging from the firewall, and localhost (the satellite firewall) gave the same "Destination Unreachable"
Signs point to the static route being improperly configured, however I have re-made and triple-checked this connection:
I am at a loss here. Packet captures provide nothing extra, and just show that the Satellite firewall is sending "Resets" because it thinks it can't route the traffic.
Any help would be appreciated.
-
@JLP
Did you configure the "allowed networks" in Wireguard on the HQ firewall? -
@viragomann Thank you so much. I am grateful you pointed it out, this would have killed me with how much it was staring me in the face.
I had the wrong config on the Satellite. I was allowing access to its own LAN through its VPN.Satellite config allowing for LAN access to itself
HQ config allowing the correct, remote network access
