WireGuard to LAN access - How to accomplish via static route?

[tibere86]

Hi all - I run a pretty simple network with a single LAN and WireGuard interface.
LAN network = 10.0.0.0/24
WireGuard network = 172.16.70.0/24

My WireGuard clients can connect to my pfSense instance fine and fully access the internet. Where I am having trouble is with accessing a LAN network device (Pihole instance) from a WireGuard client. In the WireGuard rule set, I have an allow all rule already that should, in theory, allow all WireGuard clients to access any network and the internet.

I believe I need to set up a static route between the two networks, I am just unsure how to accomplish this under the pfSense Static Route settings.

For Destination Network, do I use 172.16.70.0/24 or 10.0.0.0/24?

For Gateway, what do I create and use, 172.16.70.1 or 10.0.0.1?

[luckman212]

You do not need to declare static routes for networks that are directly connected to your pfSense gateway, such as the LAN or any VLANs you've set up (none in your case).

You do need firewall rules to allow the traffic (sounds like you've done that although a screenshot wouldn't hurt) and-

In your WG Peer setup, what do you have entered for Allowed IPs? And, on the actual WG client, what do you define as AllowedIPs in the [Peer] config? Using 0.0.0.0/0 there will route "everything" via the tunnel, or you can supply a comma separated list of networks (split-tunneling) which is usually preferred.

[giuliafw70]

For a Pi-hole on the same LAN, the missing piece is often not a pfSense static route. The LAN is directly connected, so pfSense already knows both 10.0.0.0/24 and 172.16.70.0/24. I would check two things: the WireGuard client AllowedIPs includes 10.0.0.0/24 if you are split tunneling, and the Pi-hole either uses pfSense as its default gateway or has a route back to 172.16.70.0/24. If the Pi-hole's gateway is something else, replies can go the wrong way even though the pfSense rule is wide open.