Does ANYBODY have wg-tunnel working with pfSense Wireguard?

IDtheTarget

Has ANYBODY successfully connected to a pfSense Wireguard peer from GOS? I've got it working from my laptop but haven't been able to get it working from either the Wireguard client or wg-tunnel. Here are the detailed steps I've tried, maybe you can see where I messed up. NOTE I'm starting from a functioning tunnel on my pfSense firewall. I have my laptop as a working peer on the tunnel and I'm just trying to add the GOS as a peer.

Connect my GOS to the laptop I'm using to configure the pfSense and enable file transfer. I'm doing this to copy the public keys since pfSense doesn't have the ability to create a QR code.
on pfSense, go to VPN -> Wireguard and copy the public key for the tunnel.
On the laptop, paste the public key into a txt file.
On the laptop, copy the txt file to the Download folder on the GOS phone over USB.
On GOS, open wg-tunnel and click the plus sign at the top right to add a peer.
Click "Create from Scratch".
Name the tunnel (GOS).
Touch the circle arrow to create a key-pair
touch the copy icon to copy the public key
open the notepad app and paste the public key
export the note with the public key to the Download folder for later copying to the laptop over USB
Go back to wg-tunnel
In the "Addresses" field, add the address I'm assigning to the phone through the tunnel (192.168.x.y/24)
For DNS servers, I put 1.1.1.1,8.8.8.8
For MTU I put 1420
Touch "Add peer"
Open the file with the pfSense public key
Copy the full key
go back into wg-tunnel and paste the pfSense public key
For Endpoint, enter the DDNS name of my pfSense :51820
For "Allowed IPs", I enter 192.168.0.0/16
Click the save icon.
On the laptop, copy over the file with the public key from GOS.
On pfSense, go to VPN -> Wireguard and click on the "Add Peer" icon.
Ensure that the "Enable Peer" checkbox is on
Give it a description
Enter the public key I copied from GOS
Under "Allowed IPs", use the IP from step 13, but use /32 instead of /24.
Click "Save Peer"
Click "Apply Changes"
On GOS, turn on the tunnel.
On pfSense, go to VPN -> Wireguard -> Status. My laptop is green, my GOS is red.

I don't know what else to try. The phone and the laptop are both on the same wifi. The phone doesn't have a SIM yet, I'm making sure I can do everything I need on it before I switch my account from my Samsung to the GOS.

Thank you!

n3t_admin

IDtheTarget

I don't know how it works on pfSense (I run OPNSense, so I just have a peer generator, how do they not have this?!)

and my conf looks like this:

[Interface]
PrivateKey = yourgeneratedkeyhere
Address = 10.10.1.64/32
DNS = 192.168.1.1
MTU = 1412

[Peer]
PublicKey = publickeyofyourinstance
Endpoint = your.domain:51820
AllowedIPs = 0.0.0.0/0,::/0

You should replace DNS with Cloudflare and Google, I have my DNS running locally. Apart from that, check "Allowed IPs". How does the config compare to your laptop one?

IDtheTarget

n3t_admin

I exported wg-tunnel's config and copied it over to the laptop to compare with notepad++. Some of the items were in different orders, but aside from the private keys and the assigned IP addresses, the files were identical.

I doublechecked the VPN settings, and WG Tunnel is set as Always-on VPN and "Block connections without VPN".

n3t_admin

IDtheTarget try the config in a different app like RethinkDNS as well.

I suspect the config on the pfSense is not correct.

Have you double checked the settings on the pfSense itself?

IDtheTarget

n3t_admin

I looked at the settings on pfSense and don't see any difference between the laptop and the GOS. I even tried downloading the tunnel config from pfSense and don't see any difference between the peers.

I enabled logging on the GOS in the wgtunnel app and think I see what's wrong:

AwgVPN (Red E): UAPIOpen: mkdir /data/data/ com.zaneschepke.wireguardautotunnel: permission denied - <date time stamp>

I'm guessing I need to assign some kind of storage permissions, but I don't see them in the app info. I'm running on a secondary profile. Is that a problem?

IDtheTarget

n3t_admin

Okay, so please disregard. I'm a freaking idiot. I'm used to "Always On" meaning just that. However, apparently this is a routing VPN, and the VPN isn't on until you try to pass some "interesting traffic" across it.

I had been basing my "it's not working" diagnosis on the status bar of the pfSense -> VPN -> Wireguard being red, when I hadn't actually tried accessing anything on the home network from the phone. When I actually did THAT, the status went green and I was able to access the home resources. So the thing actually works after all.

@n3t_admin , I want to thank you for trying to help me, especially when it turns out that I'm just an idiot. I actually deal with IPSec tunnels all the time at work, but our tunnels always show as up even when no traffic is passing through. So please forgive my ignorance but accept my thanks for helping! It sure is appreciated!

n3t_admin

IDtheTarget I don't know if that's related, to be honest. It's kinda hard to troubleshoot this. Maybe try importing the config on your laptop and check if it connects? That would be the solution to troubleshooting any possible misconfiguration errors.

n3t_admin

IDtheTarget no worries mate, we've all been there. Cheers!