WireGuard point-to-point for mail ports

0x44

Hi all,
I am trying to configure a WireGuard point-to-point connection from pfSense to a VPS. The goal is to route mail traffic from my local Wi-Fi AP to the mail server through the tunnel, while all other internet requests continue using the classic WAN interface (policy-based routing).

VPS Config:

[Interface]
PrivateKey = aaaaaaa
Address = 10.10.50.1/30
ListenPort = 51820

# --- IPTABLES PROTECTION BLOCK ---
PreUp = iptables -A INPUT -i wg0 -s 10.10.50.2 -m state --state ESTABLISHED,RELATED -j ACCEPT

PreUp = iptables -A INPUT -i wg0 -s 10.10.50.2 -m state --state NEW -p tcp -m multiport --dports 465,993 -j LOG --log-prefix "WG Mail Accept " --log-level 4
PreUp = iptables -A INPUT -i wg0 -s 10.10.50.2 -m state --state NEW -p tcp -m multiport --dports 465,993 -j ACCEPT

PreUp = iptables -A INPUT -i wg0 -j LOG --log-prefix "WG Reject  " --log-level 4
PreUp = iptables -A INPUT -i wg0 -j REJECT

PostDown = iptables -D INPUT -i wg0 -s 10.10.50.2 -m state --state ESTABLISHED,RELATED -j ACCEPT
PostDown = iptables -D INPUT -i wg0 -s 10.10.50.2 -m state --state NEW -p tcp -m multiport --dports 465,993 -j LOG --log-prefix "WG Mail Accept " --log-level 4
PostDown = iptables -D INPUT -i wg0 -s 10.10.50.2 -m state --state NEW -p tcp -m multiport --dports 465,993 -j ACCEPT
PostDown = iptables -D INPUT -i wg0 -j LOG --log-prefix "WG_Reject: " --log-level 4
PostDown = iptables -D INPUT -i wg0 -j REJECT

[Peer]
PublicKey = aaaaaaa
AllowedIPs = 10.10.50.2/32

Tunnels configured:

Peers added:

Outbound NAT rule created for the WireGuard interface:

Interface assigned and enabled:

The tunnel status shows as UP, but I cannot access the mailbox. The mail server is listening on 0.0.0.0 (all interfaces).

Technical details & Troubleshooting:
1 - tcpdump output on the VPS shows that handshake packets are being exchanged, but there is no encapsulated internal traffic:

sudo tcpdump -n -i any udp port 51820
tcpdump: WARNING: any: That device doesn't support promiscuous mode
(Promiscuous mode not supported on the "any" device)
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
19:13:28.753012 eth0  In  IP pfsense_ip.51820 > VPS_IP.51820: UDP, length 32
19:13:53.758125 eth0  In  IP pfsense_ip.51820 > VPS_IP.51820: UDP, length 32
19:13:53.758128 eth0  In  IP pfsense_ip.51820 > VPS_IP.51820: UDP, length 148
19:13:53.763803 eth0  Out IP VPS_IP.51820 > pfsense_ip.51820: UDP, length 92
19:13:53.777426 eth0  In  IP pfsense_ip.51820 > VPS_IP.51820: UDP, length 32

2 - Firewall: iptables logs on the VPS show that WireGuard traffic is accepted.

3 - Connectivity check: Running nc -zv 10.10.50.1 465 (from the local network to the VPS WireGuard IP) results in a timeout/no response

On pfSense, I created a firewall rule on the Wi-Fi interface matching mail ports (e.g., 465, 993) and set the WireGuard gateway as the policy-based gateway.

Any ideas on what might be causing this or how to properly debug the policy-based routing for this scenario?
Thanks for your help!

Bob.Dig

@0x44 said in WireGuard point-to-point for mail ports:

The goal is to route mail traffic from my local Wi-Fi AP to the mail server through the tunnel, while all other internet requests continue using the classic WAN interface (policy-based routing).

Where is that mail-server of yours? If it is on the VPS, that is not a task for PBR in the first place.

0x44

This post is deleted!

0x44

@Bob.Dig The mail server is indeed on the VPS. I only used PBR for testing purposes because I have strict firewall rules and isolated subnets.
Anyway, the issue is now resolved.

Below is changes that help to resolve it.
On the VPS:
PreUp = iptables -I INPUT 1 ....
PreUp = iptables -I INPUT 2 ....
......
.....

On pfSense:
Corrected the peer settings by ensuring the VPS public IP is properly set as the Endpoint

Hopefully, it will be useful to someone else.

0x44

Hi all,
I have a WireGuard point-to-point tunnel set up between pfSense and a VPS. The tunnel itself works perfectly fine. However, I am having an issue with Gateway Monitoring.

If I leave the Monitor IP default (or set it to the VPS internal WG IP), the gateway shows as offline/100% packet loss. I tried checking with tcpdump on the VPS, but it shows absolutely no incoming ICMP/ping traffic.

If I change the Monitor IP to the VPS Public IP, the gateway status switches to Online, but I immediately lose access to the VPS web server and SSH from my local network. All other internet traffic works fine.

I understand that pfSense creates a static route for the Monitor IP, forcing that traffic through the VPN, which breaks access to the VPS public services.

How can I properly configure gateway monitoring in this scenario so pfSense knows the tunnel is up, without breaking SSH and Web access to my VPS public IP?
Thanks in advance for any help!