Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    WireGuard site-to-site pfsense-to-pfsense no handshake?

    Scheduled Pinned Locked Moved WireGuard
    42 Posts 7 Posters 11.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      Jimbohello @Mikki-10
      last edited by

      @mikki-10
      did you assing interface ??

      1 Reply Last reply Reply Quote 0
      • J
        Jimbohello @Mikki-10
        last edited by Jimbohello

        @mikki-10
        create tunnel no ip
        just port number desired
        create your key's
        saved !
        go to interfaces add tun_wg0
        now add static ipv4
        set mtu to 1420
        10.100.100.2/24
        add gateway
        10.100.100.1/24
        repeat on other side
        static ipv4
        10.100.100.3/24
        add gateway
        10.100.100.1maybe this one need different (10.100.100.254/24)

        i used this setup 10.100.100.1 for gateway on both pfsense no issued yet

        M 1 Reply Last reply Reply Quote 0
        • M
          Mikki-10 @Jimbohello
          last edited by

          @jimbohello

          Hi

          Yes i did assign an interface and all that still no handshake?

          M 1 Reply Last reply Reply Quote 0
          • M
            Mikki-10 @Mikki-10
            last edited by Mikki-10

            Now it works? (the handshake)
            But why?

            M 1 Reply Last reply Reply Quote 0
            • M
              Mikki-10 @Mikki-10
              last edited by Mikki-10

              I now have this setup

              Tunnel - Site 1
              Tunnel: tun_wg0 (Site 1)
              Public key: PK1

              Peer - Site 1
              Tunnel: tun_wg0 (Site 1)
              Endpoint: Dynamic
              Public Key: PK2

              Interface - Site 1
              Description: WG
              IPv4: Static IPv4
              MTU: 1420
              IPv4 Address: 192.168.77.2/24

              Gateway- Site 1
              Interface: WG
              Name: WG_Gateway
              IPv4 Address: 192.168.77.1

              Tunnel - Site 2
              Tunnel: tun_wg0 (Site 2)
              Public key: PK2

              Peer - Site 2
              Tunnel: tun_wg0 (Site 2)
              Endpoint: <Public IP of Site 1>
              Public Key: PK1

              Interface - Site 2
              Description: WG
              IPv4: Static IPv4
              MTU: 1420
              IPv4 Address: 192.168.77.3/24

              Gateway- Site 2
              Interface: WG
              Name: WG_Gateway
              IPv4 Address: 192.168.77.1

              I now have a handshake with the above, but the gateways is offline, I do allow "any" traffic on the WG interface

              J 1 Reply Last reply Reply Quote 0
              • J
                Jimbohello @Mikki-10
                last edited by Jimbohello

                @mikki-10

                of course the gateway is offline this ins’t real wan traffic ! it’s only wireguard traffic

                just unchek monitor the gatheway

                now here the thicky part

                for subnet A to reach subnet B and virce versa you need to add a static routing

                ex : on router A
                you put subnet b and assing to gateway done before for wireguard and vice versa

                here i thing that painful right now ! if you restart wireguard service, static routing dissapear fron the route

                you need to go back to stating routing and apply back

                M 1 Reply Last reply Reply Quote 0
                • M
                  Mikki-10 @Jimbohello
                  last edited by

                  @jimbohello

                  Why do the WireGuard not start a connection if the gateway is either not set or set to not to monitor, that is so odd. But I do understand the painful part.

                  but why do they not work more similar to a tunnel interface, where insted of setting a gateway that do not exist, why don't we use the opposite IP, site 1 used the IP from site 2 as gateway and so on, or just use an different monitor IP to keep it alive, so we also have ping stats do that work?

                  also ping (to and from site 1 and 2) do not seem to work after done the above.

                  J 1 Reply Last reply Reply Quote 0
                  • J
                    Jimbohello @Mikki-10
                    last edited by Jimbohello

                    @mikki-10

                    if you go on github wireguard fron theonemcdonald issue #43 they are working on it. experimental don’t forget ! for the ping make sure your route are corresponding to your static routing ! cannot help anymore !

                    i have try also to set the gateway as the same ip
                    of the tunnel but the speed was 1/2 but it worked !

                    so thing are broken on site to site

                    use openvpn for now ! work like a charm

                    i use openvpn site to multi site for 3 years never had an issue

                    M 1 Reply Last reply Reply Quote 0
                    • M
                      Mikki-10 @Jimbohello
                      last edited by

                      @jimbohello

                      Im want to kill my openVPN (Layer2 TAP) tunnels as they do not at all work like a charm for me at all, I have a lot of tunnels and some is just working and some are sometimes broken.

                      (Yes I know WG is Layer 3 tunnel)

                      J 1 Reply Last reply Reply Quote 0
                      • J
                        Jimbohello @Mikki-10
                        last edited by Jimbohello

                        @mikki-10
                        openvpn never gave me problem ! maybe you have someting misconfigure !

                        but listen bro ! theonemcdonald is working hard to fix thing.

                        wireguard will live and rise but not yet :)

                        i do know that wireguard in pfsense 2.5.0
                        was working great for site to site but they kill it for reason ! so we will wait fow now

                        maybe you should stop your openvpn instance for your testing purpose ! maybe you should do a backup and remove all openvpn ! i remember having issue when openvpn was there with wireguard site to site

                        M 1 Reply Last reply Reply Quote 0
                        • M
                          Mikki-10 @Jimbohello
                          last edited by Mikki-10

                          @jimbohello

                          Hi I know, I have followed he's youtube videos and github pagem, and wanted to jump head first when pfsense 2.5.2 was out, as the 2.5.0 WG just worked so well for me, and therefore hoped for the best, but I did not know how broken site-to-site was at this point, but I have not lost hope, and can't wait for the new WG to get better and more stable.

                          But thanks for your help so fare, I will see if I can get it working somehow.

                          J 2 Replies Last reply Reply Quote 1
                          • J
                            Jimbohello @Mikki-10
                            last edited by

                            @mikki-10
                            like i said do backup remove all vpn and start from scratch only wireguard!

                            never know

                            anyway if problem just restore

                            have a good one

                            M 1 Reply Last reply Reply Quote 0
                            • M
                              Mikki-10 @Jimbohello
                              last edited by

                              @jimbohello

                              Hi I am on OPT18 as the next interface, not gonna happen over night, plus all the firewall rules, that is a big one 😊

                              1 Reply Last reply Reply Quote 0
                              • J
                                Jimbohello @Mikki-10
                                last edited by

                                @mikki-10
                                i tested on 2 pfsense today with no ovpn
                                no problem

                                ive did the same procedure on pfsense main office with lot’s of ovpn nothing was going as expected so ! look like openvpn is messing some shit arround

                                M 1 Reply Last reply Reply Quote 0
                                • M
                                  Mikki-10 @Jimbohello
                                  last edited by Mikki-10

                                  @jimbohello

                                  There was a closed github issue like that but just with IPsec, same thing.

                                  J 1 Reply Last reply Reply Quote 0
                                  • J
                                    Jimbohello @Mikki-10
                                    last edited by Jimbohello

                                    @mikki-10

                                    question your openvpn problematic

                                    is it on the clients side ? if so just add
                                    nobind in the *.ovpn

                                    nobind

                                    that it

                                    here’s the symptoms client connect but traffic is not goiing thru .

                                    M 1 Reply Last reply Reply Quote 0
                                    • M
                                      Mikki-10 @Jimbohello
                                      last edited by

                                      @jimbohello

                                      It is also site-to-site pfsense-to-pfsense, not sure if that will do anything for that.

                                      And other clients eg windows or linux, work just fine, but again that is an other tunnel in this case, but thanks for the tip 😊

                                      J 2 Replies Last reply Reply Quote 0
                                      • J
                                        Jimbohello @Mikki-10
                                        last edited by Jimbohello

                                        @mikki-10
                                        hahahaha
                                        i did some more digging !
                                        this is hilarious !
                                        now my wireguard SITEA GATEWAY is the ip of SITEB
                                        and my SITEB GATEWAY is the ip of SITEA !
                                        when the handshake occur all gateway are online !! and ping goes on !

                                        absolutely ASOME OR RIDICULOUS
                                        I PUT THE CONFIG BASE ON YOUR IP

                                        Interface - Site 1
                                        Description: WG
                                        IPv4: Static IPv4
                                        MTU: 1420
                                        IPv4 Address: 192.168.77.1/24

                                        Gateway- Site 1
                                        Interface: WG
                                        Name: WG_Gateway
                                        IPv4 Address: 192.168.77.2/24

                                        Interface - Site 2
                                        Description: WG
                                        IPv4: Static IPv4
                                        MTU: 1420
                                        IPv4 Address: 192.168.77.2/24

                                        Gateway- Site 2
                                        Interface: WG
                                        Name: WG_Gateway
                                        IPv4 Address: 192.168.77.1/24

                                        1 Reply Last reply Reply Quote 0
                                        • J
                                          Jimbohello @Mikki-10
                                          last edited by Jimbohello

                                          @mikki-10
                                          My SITEA

                                          Screenshot_20210711_214917.png

                                          1 Reply Last reply Reply Quote 0
                                          • J
                                            Jimbohello
                                            last edited by Jimbohello

                                            @jimbohello said in WireGuard site-to-site pfsense-to-pfsense no handshake?:

                                            @mikki-10

                                            @Mikki-10

                                            MY SITEB

                                            Screenshot_20210711_214917.png

                                            M 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.