Wireguard Routing help - 1 way working only

andresbraga

Hi everyone,
This is a noob question but already tried multiple and I hope some one can help with this.
I have a Wireguard Tunnel configured and handshake is successfully performed and I can ping the server from the laptop but can't do it otherwise. Already deactivate the NAT feature and all the rules and no luck.
Pfsense and this server is located in a Proxmox Server, laptop is a local.

Any ideas? Thank you.

patient0

@andresbraga can show a diagram of your network layout (hand-draw is ok)?

What was the reason to deactivate NAT? Did you decative it in general or only for the WG connection?

Do you have firewall rule(s) for the WG connection that allows clients to access the firewall?

relevant pfSense documentation:

Remote Access VPN:

https://docs.netgate.com/pfsense/en/latest/recipes/wireguard-ra.html

Wireguard help overview:

https://docs.netgate.com/pfsense/en/latest/vpn/wireguard/index.html

andresbraga

@patient0 said in Wireguard Routing help - 1 way working only:

What was the reason to deactivate NAT? Did you decative it in general or only for the WG connection?
General but still doesn't work.
Wireguard has any-any, None in the WAN and LAN has Any-any
Just tried everything to make this work and still no luck.

Here it is the schema of the network:

andresbraga

Also, can ping the 10.10.1.1(Pfsense) with the Wireguard connected but not the 10.10.6.1(Wireguard).

patient0

@andresbraga you have firewall rules in for LAN to allow to access the Wireguard subnet and in WIREGUARD or WG0 you rules to allow access to the LAN subnet?

Can you post a screenshot of the rules sets?

andresbraga

Hi @patient0,
Thank you for the patience,
Thew only rule that I have in LAN is this one:

But now that you say it makes sense.

patient0

@andresbraga yep, the rules are (except on floating rules) working for traffic into an interface. 'into' LAN means traffic origination from LAN, for example. 'into' WIREGUARD would refer to traffic originating from the Wireguard interface.

Therefore you would need a rule or rules on the WIREGUARD interface for traffic originating from it.

Btw: have you cropped the LAN rules? There should be a 'Allow All' rule on the LAN interface (that is created by the installer).

andresbraga

Hi again @patient0,
No, I didn't. An yeah I deleted all the rules here for this Wireguard tests.

andresbraga

Also Wireguard, only this rule:

patient0

@andresbraga that looks good, the same is needed for LAN.

andresbraga

Hi again @patient0,
Sorry to bother, already added but still the same issue.

Laptop can ping the server in the pfsense network but not the Wireguard

Also, Server cannot ping the laptop but can ping the wireguard:

Any more suggestions? Thank you,