• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

WG - Full tunnel problematic

Scheduled Pinned Locked Moved WireGuard
29 Posts 3 Posters 3.4k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • D
    dma_pf @80sCyborgNinja
    last edited by Mar 9, 2021, 3:18 PM

    @80scyborgninja said in WG - Full tunnel problematic:

    I've checked all of the rules and made adjustments as described earlier and I'm still seeing the same issue unfortunately. Could it be my OVPN PIA interface messing things up? Thanks

    First thing I see is you do not need the PIA rule. What that rule is saying is to allow any traffic coming across from PIA into pfsense. There should never be any traffic coming across from PIA that was not initiated by your networks. All traffic initiated from your networks would automatically be allowed back in through the PIA interface because it is stateful. You would never want to allow any uninitiated traffic across the tunnel.

    I'd try changing the source on the WG0 firewall rule to any for now. Enable logging and see what happens to the traffic in the firewall logs. Which interface (PIA or WAN) are you ultimately trying to route the traffic out to the internet on? What interface do you have set as the default Gateway in System/Routing?

    8 1 Reply Last reply Mar 9, 2021, 3:41 PM Reply Quote 0
    • 8
      80sCyborgNinja @dma_pf
      last edited by Mar 9, 2021, 3:41 PM

      @dma_pf I removed the PIA rule as you had recommended. I also changed the source to any on the WG0 rule and enabled logging. When I ping from the WG client to 8.8.4.4 I see nothing in the system firewall logs for destination 8.8.4.4. I am still unable to ping from the client to internet hosts.

      I am trying to route traffic from my wireguard client out the WG interface to the internet using full tunnel on the client. Currently I can only hit the LAN network from my WG client.The default gateway is set to my WAN DHCP gateway. Thanks!

      Adding a screenshot of the states as firewall logging doesn't generate for the WG0 interface.

      Screenshot_20210309_103613.png

      D 2 Replies Last reply Mar 9, 2021, 4:17 PM Reply Quote 0
      • D
        dma_pf @80sCyborgNinja
        last edited by Mar 9, 2021, 4:17 PM

        @80scyborgninja I'm seeing a couple of things that are different in your settings than mine.

        1. In the Peer settings for your Wg0 tunnel the "Peer Wireguard Address" is blank. I populated it with my tunnel network with the /24 mask as described here. So in your case I would try 10.0.10.2/24.

        2. In the Interface settings in the phone's app I have 2 things that are different than you. The Address field is populated with a mask of /24, yours is set to/32. And I set my MTU value to match the MSS value set for the Wg0 interface in pfsense. I think @Slugger had you set it for 1420. I would make sure they match.

        1 Reply Last reply Reply Quote 0
        • D
          dma_pf @80sCyborgNinja
          last edited by dma_pf Mar 9, 2021, 4:31 PM Mar 9, 2021, 4:28 PM

          @80scyborgninja One other difference. In the Wg0 firewall rule I have a gateway defined instead of any. In my particular case it's my VPN provider. I'd suggest trying to set it to your WAN for now, as using PIA is going to require an additional NAT rule.

          8 1 Reply Last reply Mar 9, 2021, 4:32 PM Reply Quote 0
          • 8
            80sCyborgNinja @dma_pf
            last edited by Mar 9, 2021, 4:32 PM

            @dma_pf Ok I made all of the changes you suggested, but still the same problem. Are you able to ping out your WG interface using pfsense Diagnostics to 8.8.4.4? I can't do that and feel that others would probably be able to with a working setup. Thanks

            D 1 Reply Last reply Mar 9, 2021, 4:34 PM Reply Quote 0
            • D
              dma_pf @80sCyborgNinja
              last edited by Mar 9, 2021, 4:34 PM

              @80scyborgninja said in WG - Full tunnel problematic:

              @dma_pf Ok I made all of the changes you suggested, but still the same problem. Are you able to ping out your WG interface using pfsense Diagnostics to 8.8.4.4? I can't do that and feel that others would probably be able to with a working setup. Thanks

              Yes, i just tried it and it works perfectly.

              8 2 Replies Last reply Mar 9, 2021, 4:35 PM Reply Quote 0
              • 8
                80sCyborgNinja @dma_pf
                last edited by Mar 9, 2021, 4:35 PM

                @dma_pf damn ok I'll try and trouble shoot that a bit. Real weird. Thanks

                1 Reply Last reply Reply Quote 0
                • 8
                  80sCyborgNinja @dma_pf
                  last edited by Mar 9, 2021, 6:53 PM

                  @dma_pf Hmm oddly, my WG gateway IP is the IP of my WG peer and I can't seem to change it as it is set to dynamic. Not sure if that is expected, but would explain all of my issues I think. Thanks

                  Screenshot_20210309_135045.png

                  D 1 Reply Last reply Mar 9, 2021, 7:30 PM Reply Quote 0
                  • D
                    dma_pf @80sCyborgNinja
                    last edited by Mar 9, 2021, 7:30 PM

                    @80scyborgninja said in WG - Full tunnel problematic:

                    @dma_pf Hmm oddly, my WG gateway IP is the IP of my WG peer and I can't seem to change it as it is set to dynamic. Not sure if that is expected, but would explain all of my issues I think. Thanks

                    Screenshot_20210309_135045.png

                    Mine looks the same way.
                    5f35df4b-39c1-4fb6-bf49-0bbf5b9565ea-image.png

                    Not sure why it would show the Peer address instead of 10.0.9.1. Nonetheless, it's working for me.

                    8 1 Reply Last reply Mar 10, 2021, 3:27 PM Reply Quote 1
                    • 8
                      80sCyborgNinja @dma_pf
                      last edited by Mar 10, 2021, 3:27 PM

                      @dma_pf @Slugger Ok I finally found the issue, only thanks to you guys! It was a weird rule setting. Thanks to the both of you for your help! Now I have access to my LAN and WAN using my Pi-Hole DNS! Happy I didn't give up. Thanks!

                      workin_rules.png

                      D 1 Reply Last reply Mar 11, 2021, 1:53 PM Reply Quote 0
                      • D
                        dma_pf @80sCyborgNinja
                        last edited by Mar 11, 2021, 1:53 PM

                        @80scyborgninja I'm glad you stumbled on a solution that worked!

                        I thought that we had tried setting a rule on Wg0 like this before:

                        Protocol: IPv4*, Source, Source Port, Destination, Destination Port: *

                        If we did I'm surprised it did not work. Did you make any other changes? Did you reboot pfsense recently and had not done that before?

                        8 1 Reply Last reply Mar 11, 2021, 2:07 PM Reply Quote 0
                        • 8
                          80sCyborgNinja @dma_pf
                          last edited by Mar 11, 2021, 2:07 PM

                          @dma_pf Yep, I did try that rule and cleared states after, also rebooted after each rule for testing. Oddly the only way I could get anything to work was with rules I have screenshoted above. Definitely very strange.

                          D 1 Reply Last reply Mar 11, 2021, 2:22 PM Reply Quote 0
                          • D
                            dma_pf @80sCyborgNinja
                            last edited by Mar 11, 2021, 2:22 PM

                            @80scyborgninja said in WG - Full tunnel problematic:

                            Definitely very strange.

                            Definitely a mystery here 👻 , but I am glad you got it working. And thanks for the feedback.

                            1 Reply Last reply Reply Quote 0
                            26 out of 29
                            • First post
                              26/29
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                              This community forum collects and processes your personal information.
                              consent.not_received