Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    WireGuard lives!

    Scheduled Pinned Locked Moved WireGuard
    90 Posts 17 Posters 31.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      dersch
      last edited by dersch

      Upgrade to 0.1.1 worked great! Thanks.

      But i'm encountering high errors out on the tun_wg interface:

      WG_DSHOME Interface (opt3, tun_wg0)
      Status up 
      IPv4 Address 192.168.166.1 
      Subnet mask IPv4 255.255.255.240 
      IPv6 Address fdac:ce55::1 
      Subnet mask IPv6 64 
      MTU 1420 
      In/out packets
      2287708/3201934 (486.02 MiB/555.38 MiB) 
      In/out packets (pass)
      2287708/3201934 (486.02 MiB/555.38 MiB) 
      In/out packets (block)
      1444/0 (208 KiB/0 B) 
      In/out errors
      0/3512 
      Collisions
      0
      

      i have no idea why and what could be the cause. Any idea or hint what could produce that errors?

      V 1 Reply Last reply Reply Quote 0
      • V
        vajonam Rebel Alliance @dersch
        last edited by vajonam

        @dersch

        Not really sure why that happens. I am running this with very few errors maybe 1 or 0. I will keep an eye on it. Just a thought maybe try adjusting the MTU depending on your WAN uplink.

        D 1 Reply Last reply Reply Quote 0
        • D
          dersch @vajonam
          last edited by

          @vajonam Its pretty strange. but i'm not using the wan for peers. So it shouldn't be related?

          V 1 Reply Last reply Reply Quote 0
          • V
            vajonam Rebel Alliance @dersch
            last edited by

            @dersch, sorry I just assumed it was over a WAN link. then I am out of ideas sorry.

            1 Reply Last reply Reply Quote 0
            • P
              psp
              last edited by

              Just upgraded to 2.6.0.a.20210524.0100-DEV:

              Crash report details:

              PHP Errors:
              [24-May-2021 18:48:49 Europe/Rome] PHP Warning: flock() expects parameter 1 to be resource, null given in /usr/local/pkg/wireguard/wg_service.inc on line 324
              [24-May-2021 18:48:49 Europe/Rome] PHP Warning: fclose() expects parameter 1 to be resource, null given in /usr/local/pkg/wireguard/wg_service.inc on line 327

              Installed pfSense v2.6.0-DEV from scratch and configured WG by hand (i.e. no import from old config.xml) after added pkg.

              WG is properly working though.

              cmcdonaldC 1 Reply Last reply Reply Quote 1
              • cmcdonaldC
                cmcdonald Netgate Developer @psp
                last edited by

                @psp I caught this a few days ago. Fix will be in the next release. It is cosmetic.

                Need help fast? https://www.netgate.com/support

                B 1 Reply Last reply Reply Quote 1
                • B
                  brians @cmcdonald
                  last edited by

                  Does this currently, or in future, work on official Netgate hardware eg. SG-5100?

                  G 1 Reply Last reply Reply Quote 0
                  • G
                    gabacho4 Rebel Alliance @brians
                    last edited by

                    @brians update to Pfsense version 21.05 RC and you will have access to the package. Unfortunately it's version 0.0.8 instead of the more current 0.1.1. Unsure why that is.

                    G 1 Reply Last reply Reply Quote 0
                    • G
                      gabacho4 Rebel Alliance @gabacho4
                      last edited by

                      @gabacho4 just manually removed the older package versions and manually reinstalled and all is well. Not as convenient as having a package to select in the package manager, but easy enough still and nice to be on current.

                      B 1 Reply Last reply Reply Quote 0
                      • B
                        brians @gabacho4
                        last edited by

                        @gabacho4 Thanks, I will just wait until official release. Was just curious because the different version numbers with PfSense + and CE.
                        Having said that, wonder if will support the ARM devices eg. SG3100.

                        V 1 Reply Last reply Reply Quote 0
                        • V
                          vajonam Rebel Alliance @brians
                          last edited by vajonam

                          @brians yup it should support ARM devices, assuming NG will build the WireGuard Kmods for all architectures. the WG pfsense package (ui) really has no dependency on architecture.

                          B 1 Reply Last reply Reply Quote 1
                          • B
                            brians @vajonam
                            last edited by

                            Wow, I upgraded SG5100 to 21.05 last night, this morning I manually installed WireGuard 0.1.2.
                            Took me a few minutes of fiddling with my iPhone, and memories of how I setup before. There is a few differences in assigning interface etc. but it very simple and I had no problems except forgetting to add firewall rule on the interface which is probably very common LOL.

                            Later will setup a 2nd SG5100 and do site to site test.

                            Let's hope this gets updated into official packages in GUI because its still at 0.0.8. I did notice package no longer shows up as available in GUI on my pfSense if I have installed manually, which is a good thing I suppose!

                            cmcdonaldC 1 Reply Last reply Reply Quote 0
                            • cmcdonaldC
                              cmcdonald Netgate Developer @brians
                              last edited by cmcdonald

                              @brians said in WireGuard lives!:

                              except forgetting to add firewall rule on the interface which is probably very common LOL.

                              This might be a good argument for adding associated pass rule creation as a feature when creating a tunnel, similar to what is done for port forwarding

                              Need help fast? https://www.netgate.com/support

                              T B 2 Replies Last reply Reply Quote 0
                              • T
                                tquade @cmcdonald
                                last edited by

                                @theonemcdonald I ran into a similar issue and stronly support your thoughts. In my view a good model to follow is that set out for IPSec and openVPN particularly with regard to outbound NAT rules when setting up a server.

                                Ted Quade

                                1 Reply Last reply Reply Quote 0
                                • B
                                  brians @cmcdonald
                                  last edited by

                                  @theonemcdonald

                                  But is it possible to even make a rule before the interface is assigned? Don't you still have to go and select/assign it after making the tunnel?

                                  1 Reply Last reply Reply Quote 0
                                  • B
                                    brians
                                    last edited by

                                    What is the purpose of Interface addresses?
                                    When I assign to an interface I assign the IP address to the interface and the values entered here previously disappear and are not used. If I un-assign they re-appear.

                                    87568326-901c-4b79-bed0-5a0d3c884f27-image.png

                                    cmcdonaldC 1 Reply Last reply Reply Quote 0
                                    • cmcdonaldC
                                      cmcdonald Netgate Developer @brians
                                      last edited by cmcdonald

                                      @brians said in WireGuard lives!:

                                      What is the purpose of Interface addresses?
                                      When I assign to an interface I assign the IP address to the interface and the values entered here previously disappear and are not used. If I un-assign they re-appear.

                                      This is for configuring WireGuard tunnels that are not assigned to a pfSense interface. Yea that is a bit confusing. But basically you can have two different types of WireGuard tunnels, which sort of depend on what you intend to do with them. It is possible to build WireGuard tunnels that aren't associated with a specific pfSense interface. These WireGuard tunnels are filtered using the "WireGuard" interface group. The addresses for unassigned tunnels are configured through the WireGuard UI. However, once you assign a WireGuard tunnel to a pfSense interface, pfSense takes over the address assignment, so the WireGaurd UI changes to reflect that...and instead you're left with a link to the native pfSense UI for configuring addresses:

                                      We do this because we don't want to step on pfSense's toes when it comes to things that it should be handling.

                                      5be9f6b4-0ce9-46a4-978c-6acba1c49206-image.png

                                      41a6cdf9-459f-45df-9b91-7e9133e5cbac-image.png

                                      06c6b9eb-03e2-4c41-9b31-ff7a06666129-image.png

                                      Need help fast? https://www.netgate.com/support

                                      B 1 Reply Last reply Reply Quote 0
                                      • B
                                        brians @cmcdonald
                                        last edited by brians

                                        @theonemcdonald ok thanks, can you give me an example of your first tunnel named Remote Access?

                                        I have my iPhone setup with an actual interface, is there a way to make it simpler without assigning an interface like this?

                                        cmcdonaldC 1 Reply Last reply Reply Quote 0
                                        • cmcdonaldC
                                          cmcdonald Netgate Developer @brians
                                          last edited by cmcdonald

                                          @brians

                                          2140cf69-ea3e-4c31-bd72-e55604ef4146-image.png

                                          ea17e9d2-ab5b-45b7-90f8-63c390cdb01c-image.png

                                          6380d096-36da-472a-80cc-491a9cb2373a-image.png

                                          fd6e2446-7bb1-4076-a7d9-55fc6135083d-image.png

                                          b8c7cb08-812c-4e9b-ac0f-b7c62f0da9cb-image.png

                                          Need help fast? https://www.netgate.com/support

                                          B 1 Reply Last reply Reply Quote 0
                                          • B
                                            brians @cmcdonald
                                            last edited by

                                            @theonemcdonald
                                            Thanks, I though I would try myself and got working and then came back to update but you already responded :)

                                            I didn't realize could do without an interface so this is much nicer...

                                            3d3360ff-f732-4f01-96de-16f211a9b88c-image.png

                                            cmcdonaldC 1 Reply Last reply Reply Quote 1
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.