ANSWERED Opnsense wireguard port forward and local network

[steven-seagull 0]

I have selective routing configured on my network using wireguard in opnsense and have the following setup:

• Host A is routed through AirVPN wireguard interface
• Host A is listening to port 56310 which is forwarded on AirVPN
• The port test is working on AirVPN's website
• Host B is not routed through AirVPN, traffic goes through WAN interface

I can connect to Host A from an external network to {airvpnIP}:port. But I can't connect to Host A from Host B (on the same LAN) using {airvpnIP}:port. Am i missing a rule to allow this connection?  Any help would be appreciated.

[go558a83nk 379]

This is typical for VPN networking.  Just connect to Host A at its LAN IP address.

[steven-seagull 0]

Right that works perfectly fine if i use the internal ip address. But i need to connect to the external/airvpn ip. Is this possible?

[steven-seagull 0]

Got it working with the help of deepseek ai:

1. Create NAT Port Forward rule
   1. Go to Firewall > NAT > Port Forward
   2. Click "Add" to create a new rule
   3. Configure with these settings:
      1. Interface: LAN
      2. Protocol: TCP/UDP (or your specific protocol)
      3. Destination: VPN provider's public IP (the one assigned to your WireGuard tunnel)
         1. I created an alias for the airdns url, ie: xyz.airdns.org and used that instead of the public IP
      4. Destination port range: The port forwarded by your VPN provider
      5. Redirect target IP: Your host's LAN IP
      6. Redirect target port: The local port on your host
      7. Description: e.g., "Hairpin NAT for VPN host access"
      8. Filter rule association: "Add associated filter rule"
2. Verify Firewall Rule
   1. Go to Firewall > Rules > LAN
   2. Look for a rule that allows traffic to your host's LAN IP on the specified port
3. Add Outbound NAT Rule
   1. Go to Firewall > NAT > Outbound
   2. Enable "Hybrid outbound NAT rule generation"
   3. Add a manual rule:
      1. Interface: LAN
      2. Source: LAN net
      3. Destination: Your host's LAN IP
      4. NAT Address: Your OPNsense LAN IP
      5. Static Port: Checked