ANSWERED [SOLVED] OPNSense WireGuard configuration

[mazgacash 0]

Hi, after years of using pfSense with OpenVPN i wanna migrate to opnsense and wireguard.
In OPNsense documentation https://docs.opnsense.org/manual/how-tos/wireguard-selective-routing.html Step 2 i´ve to set a gateway ip as also used in step 6 but i dont know which ip i should set.
my primary setup would be that one interface on opnsense go out throug airvpn.
can somebody help me please or give ma a hint?

regards ng

[mazgacash 0]

Any ideas, i believe that i´m not the only one searching for this solution
regards ng

[Wolke68 5]

Search for PfSense in the Wireguard thread 

[securvark 16]

Im at the same problem guys, instead of useless replies can someone please just post a solution or a link because my searches are coming up empty.

Ive ran for years on pfsense with openvpn and I have setup an openvpn on opnsense now as well. It works the same as on pfsense. Once the VPN is up and the interface created and activated, two gateways appear automatically which can be customized and used in firewall rules for routing traffic.

With Wireguard, the gateways don't appear. The connection seems to work :
 

interface: wg1
  public key: abc123blablabla=
  private key: (hidden)
  listening port: 9829

peer: whateverrandomkey=
  preshared key: (hidden)
  endpoint: 213.152.162.148:1637
  allowed ips: 0.0.0.0/0
  latest handshake: 16 seconds ago
  transfer: 9.43 KiB received, 2.89 KiB sent
  persistent keepalive: every 15 seconds

and handshake appears as well.

Any help would be appreciated!

[go558a83nk 362]

there may not be very many people here that run opnsense.  I wish I could help but I'm still using pfsense.

[securvark 16]

7 hours ago, go558a83nk said:

there may not be very many people here that run opnsense.  I wish I could help but I'm still using pfsense.

Its very similar. Did your gateway appear automatically after creating the wireguard connection and interface? Mine doesn't.

To which server are you connecting and what gateway address does it pick?

Thanks!

[go558a83nk 362]

7 hours ago, securvark said:

Its very similar. Did your gateway appear automatically after creating the wireguard connection and interface? Mine doesn't.

To which server are you connecting and what gateway address does it pick?

Thanks!

If I recall correctly the interface must be setup manually *and* then the gateway.  So, no, it doesn't appear automatically.

[securvark 16]

13 minutes ago, go558a83nk said:

If I recall correctly the interface must be setup manually *and* then the gateway.  So, no, it doesn't appear automatically.

Oke, that's oke I can do that .. but where do I find the gateway address?

With OpenVPN, the gateway address is set to "dynamic", and I cannot select the same when I create a gateway manually so I still need a gateway address in order to manually create the gateway.

Thanks!

 

[go558a83nk 362]

12 minutes ago, securvark said:

Oke, that's oke I can do that .. but where do I find the gateway address?

With OpenVPN, the gateway address is set to "dynamic", and I cannot select the same when I create a gateway manually so I still need a gateway address in order to manually create the gateway.

Thanks!

 

 
I'm pretty sure I followed a guide back when I first started using wireguard on pfsense...a guide made by the guy that made the wireguard add-on package.  Anyway, I have gateway address set to the same as interface address.  When creating the interface I have to put in the internal IP that's given to me in the config and the same one goes in the gateway.

[securvark 16]

I cannot edt the subject, I would tag it [resolved] but its not my topic.

Nevertheless, the solution (for me) was this tickbox on the interface for the tunnel:

[go558a83nk 362]

8 minutes ago, securvark said:

I cannot edt the subject, I would tag it [resolved] but its not my topic.

Nevertheless, the solution (for me) was this tickbox on the interface for the tunnel:

and I wouldn't have even known that since I don't think I've ever seen that in pfsense

[securvark 16]

1 hour ago, go558a83nk said:

and I wouldn't have even known that since I don't think I've ever seen that in pfsense

I overlooked it until today. The gateway is automatically created similarly to how its created when adding a OpenVPN interface. In that case, I don't need to enable this.

Creating a manual gateway with address 'dynamic' isn't possible and using the interface address as a gateway address doesn't work, even though the gateway seems to work and a monitor IP seems to be reachable.

[Air4141841 24]

generate your airvpn configuration file
under interface address is the key here... and the number you need for each tunnel

create a successful Wireguard connection and Enable it if it doesn't handshake start over until it does.    then go to interface> assignments and enable and name appropriate the WG1 interface that now shows up
 IP configuration type is static ip4 MTU should be 1420. at least that works for me 

at the Very bottom Static IP4 should be your interface IP address in the configuration file.
your not done.   upstream gateway should be created AND assigned and its that same number... auto detected is absolutely incorrect 



 

[theocean 4]

In case this helps anyone in future - When creating a port forward for a Wireguard interface in OPNSense, the automatic firewall that is created doesn't work.

To fix this, go to the wireguard interface firewall rules.  Create a new rule that's the same as the automatic firewall rule, except click "Advanced features: Show/Hide" and set "reply-to" to the wireguard interface.  Then go back to the port forward rule and set "Filter rule association" to "None" to remove the original (broken) firewall rule.

 

[cheapsheep 6]

On 6/23/2023 at 11:12 PM, theocean said:

In case this helps anyone in future - When creating a port forward for a Wireguard interface in OPNSense, the automatic firewall that is created doesn't work.

To fix this, go to the wireguard interface firewall rules.  Create a new rule that's the same as the automatic firewall rule, except click "Advanced features: Show/Hide" and set "reply-to" to the wireguard interface.  Then go back to the port forward rule and set "Filter rule association" to "None" to remove the original (broken) firewall rule.

 

THANKS!
This is not only WireGuard specific, but also has to be done for OpenVPN. And: Do not forget to move the newly created rule (with the correct reply-to settings) to the top.

[Clisthenes Mahesha 0]

On 6/23/2023 at 9:12 PM, theocean said:

In case this helps anyone in future - When creating a port forward for a Wireguard interface in OPNSense, the automatic firewall that is created doesn't work.

To fix this, go to the wireguard interface firewall rules.  Create a new rule that's the same as the automatic firewall rule, except click "Advanced features: Show/Hide" and set "reply-to" to the wireguard interface.  Then go back to the port forward rule and set "Filter rule association" to "None" to remove the original (broken) firewall rule.

 

omg you're a hero, thank you so much for this tip!

I spend troubleshooting this for around a day and finally was able to get it solved, thank you!!