<![CDATA[WireGuard, Two Firewall Entries]]>Hi,

Likely a dumb question, but just not fitting with my brain (yet) 🤣 . In my Firewall Rules, I see two WireGuard entries ... seems like one is interface, the other the "application" (for lack of a better term). Should there be? And what is the difference / which one is needed?

Thanks!

]]>https://forum.netgate.com/topic/160302/wireguard-two-firewall-entriesRSS for NodeFri, 16 Oct 2026 18:17:49 GMTThu, 28 Jan 2021 03:46:51 GMT60<![CDATA[Reply to WireGuard, Two Firewall Entries on Fri, 29 Jan 2021 20:21:06 GMT]]>@vbman213 That link helps, appreciate it!

]]>https://forum.netgate.com/post/960470https://forum.netgate.com/post/960470Fri, 29 Jan 2021 20:21:06 GMT<![CDATA[Reply to WireGuard, Two Firewall Entries on Fri, 29 Jan 2021 19:02:32 GMT]]>@arrmo The order is somewhat arbitrary, fwiw you can change the ordering to alphabetical if you want in General Setup settings.

Thttps://docs.netgate.com/pfsense/en/latest/nat/process-order.html

]]>https://forum.netgate.com/post/960445https://forum.netgate.com/post/960445Fri, 29 Jan 2021 19:02:32 GMT<![CDATA[Reply to WireGuard, Two Firewall Entries on Fri, 29 Jan 2021 17:37:36 GMT]]>@griffo said in WireGuard, Two Firewall Entries:

The Group rules are processed first, then the interface rules. Just like floating rules and interface rules on the firewall.

Just to clarify (make sure I have it correct 🤣). It seems like the rules are processed Left to Right, as they show up in the webConfigurator. Correct?

Thanks!

]]>https://forum.netgate.com/post/960434https://forum.netgate.com/post/960434Fri, 29 Jan 2021 17:37:36 GMT<![CDATA[Reply to WireGuard, Two Firewall Entries on Thu, 28 Jan 2021 17:31:10 GMT]]>@griffo That makes sense, thanks! So if I pass at the Group level, no need for a rule "below" that (i.e. interface).

Appreciate it!

]]>https://forum.netgate.com/post/960165https://forum.netgate.com/post/960165Thu, 28 Jan 2021 17:31:10 GMT<![CDATA[Reply to WireGuard, Two Firewall Entries on Thu, 28 Jan 2021 06:33:05 GMT]]>@arrmo It's explained in the doco.
https://docs.netgate.com/pfsense/en/latest/vpn/wireguard/rules.html

The Group rules are processed first, then the interface rules. Just like floating rules and interface rules on the firewall.

So I think for inbound traffic the order will be Floating -> Wireguard -> wgx but outbound is a little more complicated.

]]>https://forum.netgate.com/post/960024https://forum.netgate.com/post/960024Thu, 28 Jan 2021 06:33:05 GMT