Hi,
I just tried experimenting with wireguard. I have successfully set up my opnsense wireguard and one android client. It works perfectly as default gw to all traffic.
Now I added f36 as client. I used network manager gui to create the tunnel according to instructions here: gui-guide
I get the tunnel up, looking from sudo wg
I can see packets are moving. Also from the server end.
╰─$ sudo wg
interface: wg0
public key: (hidden)
private key: (hidden)
listening port: 52412
fwmark: 0xcadd
peer: (hidden)
endpoint: (hidden):55555
allowed ips: 0.0.0.0/0
latest handshake: 11 seconds ago
transfer: 8.98 KiB received, 1.68 GiB sent
However none of the traffic I try to create works. No ping, no web surfing. I see it’s correctly set up as default gw, but still. What coud I miss?
╰─$ ip r s
default via 192.168.116.1 dev wg0 proto static metric 50
default via 192.168.21.99 dev wlp2s0 proto dhcp src 192.168.21.29 metric 20600
192.168.21.0/24 dev wlp2s0 proto kernel scope link src 192.168.21.29 metric 600
192.168.116.0/24 dev wg0 proto kernel scope link src 192.168.116.21 metric 50
My opnsense wg server has wg address 192.168.116.1/24, and the DNS is behind it in LAN address 192.168.117.1. See config from f36 client here:
===============================================================================
Connection profile details (pilivi)
===============================================================================
connection.id: home
connection.uuid: 47feddae-77ad-4edf-8cbf-fb53c49d28b9
connection.stable-id: --
connection.type: wireguard
connection.interface-name: wg0
connection.autoconnect: no
connection.autoconnect-priority: 0
connection.autoconnect-retries: -1 (default)
connection.multi-connect: 0 (default)
connection.auth-retries: -1
connection.timestamp: 1658735388
connection.read-only: no
connection.permissions: --
connection.zone: --
connection.master: --
connection.slave-type: --
connection.autoconnect-slaves: -1 (default)
connection.secondaries: --
connection.gateway-ping-timeout: 0
connection.metered: unknown
connection.lldp: default
connection.mdns: -1 (default)
connection.llmnr: -1 (default)
connection.dns-over-tls: -1 (default)
connection.wait-device-timeout: -1
-------------------------------------------------------------------------------
ipv4.method: manual
ipv4.dns: 192.168.117.1
ipv4.dns-search: --
ipv4.dns-options: --
ipv4.dns-priority: 0
ipv4.addresses: 192.168.116.21/24
ipv4.gateway: 192.168.116.1
ipv4.routes: --
ipv4.route-metric: -1
ipv4.route-table: 0 (unspec)
ipv4.routing-rules: --
ipv4.ignore-auto-routes: no
ipv4.ignore-auto-dns: no
ipv4.dhcp-client-id: --
ipv4.dhcp-iaid: --
ipv4.dhcp-timeout: 0 (default)
ipv4.dhcp-send-hostname: yes
ipv4.dhcp-hostname: --
ipv4.dhcp-fqdn: --
ipv4.dhcp-hostname-flags: 0x0 (none)
ipv4.never-default: no
ipv4.may-fail: yes
ipv4.required-timeout: -1 (default)
ipv4.dad-timeout: -1 (default)
ipv4.dhcp-vendor-class-identifier: --
ipv4.dhcp-reject-servers: --
-------------------------------------------------------------------------------
ipv6.method: ignore
-------------------------------------------------------------------------------
wireguard.private-key: <hidden>
wireguard.private-key-flags: 0 (none)
wireguard.listen-port: 0
wireguard.fwmark: 0x0
wireguard.peer-routes: yes
wireguard.mtu: 0
wireguard.ip4-auto-default-route: -1 (default)
wireguard.ip6-auto-default-route: -1 (default)
-------------------------------------------------------------------------------
proxy.method: none
proxy.browser-only: no
proxy.pac-url: --
proxy.pac-script: --
-------------------------------------------------------------------------------
The allowed routes in nm configurator is set to 0.0.0.0/0, so it would become the default gw.
While connection is up, it looks like this:
╰─$ nmcli d show wg0
GENERAL.DEVICE: wg0
GENERAL.TYPE: wireguard
GENERAL.HWADDR: (unknown)
GENERAL.MTU: 1420
GENERAL.STATE: 100 (connected)
GENERAL.CONNECTION: home
GENERAL.CON-PATH: /org/freedesktop/NetworkManager/ActiveConnection/18
IP4.ADDRESS[1]: 192.168.116.21/24
IP4.GATEWAY: 192.168.116.1
IP4.ROUTE[1]: dst = 192.168.116.0/24, nh = 0.0.0.0, mt = 50
IP4.ROUTE[2]: dst = 0.0.0.0/0, nh = 0.0.0.0, mt = 50, table=51933
IP4.ROUTE[3]: dst = 0.0.0.0/0, nh = 192.168.116.1, mt = 50
IP4.DNS[1]: 192.168.117.1
IP6.ADDRESS[1]: fe80::31a2:e334:cf60:5127/64
IP6.GATEWAY: --
IP6.ROUTE[1]: dst = fe80::/64, nh = ::, mt = 256
Any ideas what is missing?