๐ก OPNsense WireGuard Client Handshake & Routing โ Executive Summary
Technical architectural analysis, practical configuration manifests, and deployment instructions for OPNsense WireGuard Client Handshake & Routing.
WireGaurd Client hardware dependent issue
References and Guidelines (NOTE)
All of the cases below are issues that occur due to the declaration of a split tunnel. Possible solution with full-vpn
Android Mobile (Samsung Galaxy s25 Ultra)
References and Guidelines (NOTE)
Failed to find private DNS when declaring multiple DNS
- When:
bash
DNS = 192.168.1.53, 8.8.8.8, 1.1.1.1
AllowedIPs = 10.0.X.X/24, 118.37.2.0/24, 192.168.118.0/24- Mac OS โ
WG Client:succeed - Samsung Galaxy s25 Ultra โ
WG Client:failed - When:
AllowedIPs = 0.0.0.0/0, ::/0(Full VPN Tunnel) - Internal โ TCP/UDP/DNS:
succeed - External (ex 8.8.8.8) โ TCP/UDP/DNS:
failed - Solved?:
- Public DNS is not required for normal operation of the split tunnel, so configure as follows (
all-succeed)
bash
DNS = 192.168.1.53
AllowedIPs = 10.0.X.X/24, 118.37.2.0/24, 192.168.118.0/24wg-quick CLI on Mac
References and Guidelines (NOTE)
Internal connection is not possible when setting up a split tunnel, and Internet connection is not possible when using a full VPN tunnel.
- Needs Action:
telnet 192.168.118.53 53 - Mac OS โ
WG Client:-
succeed:
bash
AllowedIPs = 10.0.X.X/24, 118.37.2.0/24, 192.168.118.0/24 DNS = 192.168.118.53 -
- Mac OS โ CLI:
failed:
bash
AllowedIPs = 10.0.X.X/24, 118.37.2.0/24, 192.168.118.0/24
DNS = 192.168.118.53- succeed: (but internal Only) = failed: telnet 8.8.8.8 53
bash
AllowedIPs = 0.0.0.0/0, ::/0
DNS = 192.168.118.53Full-VPN
- When WAN connection is possible using Full-VPN, all client-dependent problems defined above are resolved.
bash
AllowedIPs = 0.0.0.0/0, ::/0
DNS = 192.168.118.53- solved
-
Client Config
txt
[Interface] PrivateKey = <secret> Address = 10.0.X.X/32 DNS = 192.168.118.53 [Peer] PublicKey = <secret> AllowedIPs = 0.0.0.0/0, ::/0 Endpoint = <WAN>:41821 PersistentKeepalive = 25
-
Client Config
Leave a Reply