WireGuard, Two Firewall Entries

arrmo

Hi,

Likely a dumb question, but just not fitting with my brain (yet) . In my Firewall Rules, I see two WireGuard entries ... seems like one is interface, the other the "application" (for lack of a better term). Should there be? And what is the difference / which one is needed?

Thanks!

Griffo

@arrmo It's explained in the doco.
https://docs.netgate.com/pfsense/en/latest/vpn/wireguard/rules.html

The Group rules are processed first, then the interface rules. Just like floating rules and interface rules on the firewall.

So I think for inbound traffic the order will be Floating -> Wireguard -> wgx but outbound is a little more complicated.

arrmo

@griffo That makes sense, thanks! So if I pass at the Group level, no need for a rule "below" that (i.e. interface).

Appreciate it!

arrmo

@griffo said in WireGuard, Two Firewall Entries:

The Group rules are processed first, then the interface rules. Just like floating rules and interface rules on the firewall.

Just to clarify (make sure I have it correct ). It seems like the rules are processed Left to Right, as they show up in the webConfigurator. Correct?

Thanks!

cmcdonald

@arrmo The order is somewhat arbitrary, fwiw you can change the ordering to alphabetical if you want in General Setup settings.

Thttps://docs.netgate.com/pfsense/en/latest/nat/process-order.html

arrmo

@vbman213 That link helps, appreciate it!