Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfSense on Proxmox with WireGuard

    Scheduled Pinned Locked Moved Routing and Multi WAN
    11 Posts 2 Posters 1.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      j0hsm1tty
      last edited by

      Hi there,

      Since a few weeks I'm playing around with a Protectli hardware device, Proxmox on it and pfSense. Working great!
      I am having a 1.2gbs connection and getting almost full speed, even when I'm behind a WireGuard VPN.
      The reason I'm having my router virtualized is because I can and I like to play around and learn.

      My question: Until I installed a VPN tunnel with WireGuard, I was able to switch between host (Proxmox) and router (pfSense) on both their LAN IP adresses.
      Proxmox 192.168.178.36 (My "WAN" side, IP obtained from DHCP)
      pfSense 192.168.1.1

      Now since everything is behind the VPN I cannot anymore.

      The reason must probably lie in the firewall rules, but I don't know what to change so I can access the Proxmox GUI again.

      f57a6387-79e3-4677-b813-4aeecd667475-image.png

      Any thoughts on how to fix this?

      I'm here to learn so a heading in the good direction is also very welcome! Thanks in advance.

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @j0hsm1tty
        last edited by

        @j0hsm1tty
        Your WG rules policy routes any traffic to the VPN gateway apart from the LAN address. So traffic to Proxmox IP is not allowed.

        You have to put a pass rule with destination = Proxmox above of the WG rules to get access.

        However, as your network may grow in the future do it on the smart way yet:
        Create an Firewall > Aliases of type networks and add all private networks to it. Call it RFC1918.
        Then replace the "LAN address" destination in your second rule with this alias.
        This assumes that you don't need to access private networks over the WG. Meas that you only use it for internet access.

        With this alias you can also access other local (private) networks from LAN network in case you add any in the future.

        J 1 Reply Last reply Reply Quote 0
        • J
          j0hsm1tty @viragomann
          last edited by

          @viragomann

          Thanks for helping me in the right direction!

          I noticed when I made changes in the firewall rules my browser on the client side kept loading longer, so something has changed. But I still can't acces the Proxmox GUI.
          A little more research made me find out that one of the gateways has a problem. I'm not sure if this came due to some firewall rules, OR that the firewall rules are in place and the gateway setting are not right.

          11db86ad-94e8-4561-8401-00e8ef5b4c3e-image.png

          I did made the firewall rule like you said, with the whole IP range in an alias.

          06f16099-886e-4376-abbc-4f854d4878f0-image.png

          a42777df-f46e-44c7-bd20-0836e2a2f042-image.png

          And hereby the specific rule. From my LAN side.

          a38b4041-f0a4-426e-84d2-0816965d13a1-image.png

          Could it have something to do with a outgoing gateway? (WireGuard VPN?)

          Hoping you can help me out.
          Thanks in advance!

          V 1 Reply Last reply Reply Quote 0
          • V
            viragomann @j0hsm1tty
            last edited by

            @j0hsm1tty
            The gateway offline state just means that the gateway is not responding to the monitoring pings.
            Anyway, monitoring the local router doesn't give a good review about the internet connection. You should consider to monitor an IP in the internet, which is responding top pings, e.g. 8.8.8.8.
            You can set the in System > Routing > Gateways > Edit the concerned gateway.

            Your RFC1918 alias contents only the routers IP? This makes no sense. It's not the router you want access, but Proxmox as I got you.
            And the suggestion with the alias aimed to include all RFC 1918 networks to it like this:
            3fbcb3a4-8ca3-4eab-a8d0-5e1f0c89b192-grafik.png

            Could it have something to do with a outgoing gateway? (WireGuard VPN?)

            No, the Proxmox IP is within the WAN subnet. So pfSense doesn't send packets destined to it to any gateway.

            I suspect that your outbound NAT is in automatic mode. Natting the traffic is even necessary, otherwise Proxmox would send responses to the upstream gateway, since it doesn't know the network behind pfSense.

            J 1 Reply Last reply Reply Quote 0
            • J
              j0hsm1tty @viragomann
              last edited by

              @viragomann

              Thank you. I changed the private networks as you suggested. I kept the firewall rules for the LAN network the same.

              Maybe I made a mess of the outbound NAT, but these are my settings.

              e1fc66b5-9f2b-46d1-a333-459f7a6ba1f1-image.png

              Do I need to make an extra line for outbound traffic for my internal network?
              I'm sorry for my maybe n00b questions.

              V 1 Reply Last reply Reply Quote 0
              • V
                viragomann @j0hsm1tty
                last edited by

                @j0hsm1tty said in pfSense on Proxmox with WireGuard:

                Maybe I made a mess of the outbound NAT,

                Seems so.
                Copy the last rule by ticking the copy button at the right (assuming the source is your LAN subnet) and change the interface to WAN.

                Basically there is no reason to switch over to manual rule generation for your set up. Just use the hybrid mode, so you keep the automatically generated rules and can add your own rules to override them.

                J 1 Reply Last reply Reply Quote 0
                • J
                  j0hsm1tty @viragomann
                  last edited by

                  @viragomann

                  I cleaned it out and added the WAN source source. Still the same.

                  69fa010c-d90c-4d21-b76a-f00784b1fca1-image.png

                  What I found out, when I clicked the specific state is this.
                  The 192.168.1.100 is my local PC, the 192.168.178.36 the Proxmox machine.

                  3de9a9df-8c9f-41b0-a51b-a9bb92c5c6ce-image.png

                  Could this have anything to do with these floating rules?
                  57c49cf3-dfe4-4926-96bf-028d862a2c9f-image.png

                  Looks like becoming a wild goose chase.

                  V 1 Reply Last reply Reply Quote 0
                  • V
                    viragomann @j0hsm1tty
                    last edited by

                    @j0hsm1tty
                    The outbound NAT should be fine now. Even the manually created rule is useless, since there is already an automatic rule for this purpose.

                    Could this have anything to do with these floating rules?

                    If this reject rule is with direction out, then yes.
                    Also the pass rule only makes sense with direction out.

                    J 1 Reply Last reply Reply Quote 0
                    • J
                      j0hsm1tty @viragomann
                      last edited by

                      @viragomann

                      I am really sorry Viragomann, I should have started asking with:

                      Could this have anything to do with these floating rules?

                      Because, IT WORKS!

                      I made these rules for a "kill switch" reason. I toggled these rules off and instantly I was able to go back to the Proxmox GUI.

                      Really happy with your help and your patience! Great! Thank you very much.

                      V 1 Reply Last reply Reply Quote 0
                      • V
                        viragomann @j0hsm1tty
                        last edited by

                        @j0hsm1tty said in pfSense on Proxmox with WireGuard:

                        I made these rules for a "kill switch" reason.

                        I see.
                        So you have to add an additional pass rule for the WAN subnet above of the reject rule.

                        J 1 Reply Last reply Reply Quote 0
                        • J
                          j0hsm1tty @viragomann
                          last edited by

                          @viragomann

                          Again, very happy with your help! Up to my next learnings!

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.