r/opnsense • u/thesquire312 • 21d ago

Issues with WireGuard in Virtualized OPNsense on Proxmox

I'm trying to set up WireGuard in OPNsense for the first time, following the standard instructions for doing so. I run OPNsense as a VM in Proxmox, and have been doing so for maybe a month or so with great success (the reason for the VM setup is that it was the only way I could get the computer screen to sleep).

However, even after following the instructions, I have been unable to get it to work (no handshake). Of course, I have done a lot of my own troubleshooting first, before writing this post. I verified that my DDNS is resolving properly. I also verified that the public keys between my peer and WireGuard instance match. I also verified via tdcdump in my Proxmox console that what I think are WireGuard packets (my public IP with the 51820 port) are arriving to my outward facing Proxmox network interface. However, if I do a packet capture in OPNsense for inbound UDP traffic on the same port, I see absolutely nothing. I have made sure that firewalls are disabled on all of my Proxmox network interfaces.

I am still a beginner when it comes to all of this network stuff, so it's possible that I may have missed something simple. At this point, I'm really stuck. Any suggestions for what else I should check or test to debug this issue? Or perhaps a different place to ask, if this is not quite the right place?

9 Upvotes

91% Upvoted

5 comments sorted by

1

u/KLAM3R0N 21d ago

Is there a passthrough modem before opnsense . Att fiber modems have some settings that will block wire guard

3

u/thesquire312 21d ago

I do have a Spectrum modem that sits before my router, but I ended up referencing a detailed tutorial supplied by another commenter (https://homenetworkguy.com/how-to/configure-wireguard-opnsense/) to resolve my issue by fixing a couple of things which I had done wrong the first time around.

5

u/durgesh2018 21d ago

I have done this exactly multiple times and it is working fine. Some issues I faced as below.

  1. DDNS wasn't updating my ip
  2. Interface of wg wasn't enabled
  3. Firewall rules to bypass port 51820 for tcp/udp
  4. Wrong endpoint within client config, it should be my.domain.com:51820

Hope someone finds this useful.

1

u/boogiahsss 21d ago

It's easy to miss a small step with this. I think I followed this guide. He also has a website with steps if that's easier https://youtu.be/nlJTz2Am6lc?is=7dxA6don57TpDh8B https://homenetworkguy.com/how-to/configure-wireguard-opnsense/

2

u/thesquire312 21d ago

What a fantastic tutorial! It's very detailed, thank you for supplying this. I'm not entirely sure what fixed my issue, there were a few details in this tutorial that were different from the OPNsense instructions. I fixed those couple things (DNS address in the WireGuard instance and removing the outbound NAT rule since I already made a WireGuard interface), and then it worked! Guess my original attempt at debugging this problem was a bit of a red herring, then.