• Required to reliably request a VPN instance endpoint from an external network

Server in OPNSense

Create instance and enable

• WG Instance / Peers
• CIDR: 10.0.X.X/24
• Instance: 10.0.X.X/24 (instance address is 10.0.X.X, peer addresses are assigned sequentially)

Create instance

• Tunnel band: ex) 10.0.X.X/24

Enable

Create peer

Create manually (only when necessary)

• Generating private and public keys

mkdir wg-mgnt-peer1
  cd wg-mgnt-peer1/
  #wg genkey > privatekey
  #cat privatekey
  #cat privatekey | wg pubkey > publickey
  #cat publickey
  wg genkey | tee privatekey | wg pubkey > publickey

• Information actually stored
• Allowed peering IP ranges
• Public key
• Instance Mapping
• keepalive
• No need to store this information for peer configuration
• Endpoint address
• Endpoint port

Created with peer generator

• The endpoint is the Listen Port of the instance
• Name definition
• Definition of allowed IPs: Must contain the same band as the instance. ex) 10.0.X.X/24
• KeepAlive: 25
• Caution:
• Must proceed with client registration.

• Private keys cannot be viewed after this screen

• Click the Apply button

Client

Installation

Config

• interface: Client tunnel settings (not saved on the server. For defining client configuration)
• Address: IP range to be used by the tunnel
• DNS: Private DNS to use on the client side
• peer: Connection configuration information with peer
• AllowedIPs: VPN Tunneling Range
• Endpoint: VPN instance endpoint
• Sample

[Interface]
  PrivateKey = <secret>
  Address = 10.0.X.X/32
  DNS = 192.168.118.53

  [Peer]
  PublicKey = <secret>
  #AllowedIPs = 0.0.0.0/0
  AllowedIPs = 10.0.X.X/24, 118.37.2.0/24, 192.168.118.0/24
  Endpoint = <ddns>:41821
  PersistentKeepalive = 25

Mobile

• Use QR in WireGuard App

PC

• A tunnel is used when the IP of the destination traffic requested by the client is in Allowed.

  • All: 0.0.0.0/0

    – DNS query may not be possible when tunneling all traffic, so declare DNS = 8.8.8.8, 1.1.1.1 in Interface.

  • VPN band (required): 10.0.X.X/24
  • WAN Band (check my settings): 118.37.2.0/24

• Copy the config on the peer generator side to configure the tunnel

Issues

Add port forwarding

• WAN Interface: WireGuard Instance
• If configured as above, WAN address: 41821 forwarding is required

• Note

  – Configuration
  – Interface: WAN
  – Protocol: UDP
  – Destination: WAN address
  – Destination port range: 41821 \~ 41821
  – Destination IP redirection: Single host or network – 127.0.0.1/32
  – Destination port redirection: 41821

Check status

Feature: WAN Service Port Security (Dest WAN)

• Add interface

  • Note:
  • Since it is a tunnel interface, just enable the IPv4 configuration type to None.

• Client Setup

• Allow VPN bandwidth and WAN bandwidth
  • AllowedIP = 10.0.X.X/24, 118.37.2.0/24
• VPN Interface: Service Port

• AS-IS port forwarding policy:
  • Interface: WAN
  • From: any
  • Destination: WAN address
  • Destination IP redirection: Single host or network

• TO-BE Port Forwarding Policy (Dest WAN):

  • Interface: VPN1
  • Source: VPN1 net
  • Destination: WAN address
  • Destination IP redirection: Single host or network

  Example)

Feature: WAN Service Port Security (Dest New Subnet) (for DNS)

• If you use the existing 192.168.1.0/24, when accessing from the internal wifi, the DHCP internal network is given priority and access becomes impossible.
• In the case of a mobile phone, it was able to connect even if it was connected to WiFi, but I wasted quite a bit of time on this issue. I think they probably used LTE because priority access to the internal network was not possible.
• In my case, I defined the band 192.168.118.0/24.

Advantages

• IP can be divided, eliminating insignificant ports.
• Private DNS binding becomes possible.
• SSL configuration becomes possible.

Disadvantages

• Cumbersome compared to WAN.

• Client Setup

• VPN band, WAN band, new subnet allowed
  • AllowedIP = 10.0.X.X/24, 118.37.2.0/24, 192.168.118.0/24
• VPN Interface: Service Port

• Port Forwarding Policy (Dest new Subnet):

  • Interface: VPN1
  • Source: VPN1 net
  • Destination: Freely configured within the range 192.168.118.1 to 192.168.118.255 (single host)
  • Destination IP redirection: Single host or network

  Example)

• DNS Setup

• SSL Setup

CLI