i’m having an issue with my wireguard connections i can’t resolve since updating to U200.
Prior to the update all wireguard connections worked fine - including forwarding traffic from a connected smartphone.
After installing the update and restarting the my ipfire devices connected per wireguard suddenly were disconnected from the internet.
The wireguard connection itself is still working fine. It is successfully established and i can connect to the ipfire itself (for example the webinterface) if configured.
But in ipfires wireguard interface the connected devices are still shown as offline/not connected.
By looking at the firewall protocolls i found out that http(s) traffic from the connected wireguard devices is logged as comming from the green interface (green0) after installing U200 (because there are no rules to allow these devices from green - and thats the only logs currently appearing from the wireguard-ips.
Prior to the update the logges only showed connections to be from wg0 - what i would consider the correct interface and what worked fine (no http(s) logs, cause logging was not enabled for these).
I have not been able to find any information that the change of the recognized interface is intended with the update, nor any information why this might have happend or how to revocer the issue.
I didn’t change the ruleset or the log settings or anything else. The log for example for DNS don’t occour anymore at all - neither with green0 nor wg0.
Anybody here has any ideas/suggestions or the maybe the same issue?
Which ones do you need to see?
I don’t have special rules for the wireguard device but keept all possible routes for my smartphone in one rule-set independet of beeing on Wireguard or directly on Blue Interface.
I’m primarly concerned about the IPs of the wireguard interface beeing recognised as “green0” in the logs and assume thats causing the issue.
I have complete seperate sets of IP-Adresses assigned to green, blue, wireguard and OpenVPN. And i don’t get why an adress from the wireguard adress space is logged on the green interface.
Hello,
sorry for letting this topic fall down for 2 weeks.
I still haven’t found any solution or even hint on this - has anybody any idea what might cause this?
It startet exactly with the update to U200.
As soon as i activate the Wireguard connection on my phone i get the drop_package logs from the green interface - with the correct ip address for the Wireguard client which is completely separate from the green interface.
I still wasn’t able to get my wireguard setup working again.
I tried to create explicit extra rules for the case my phone is connected via wireguard and so on. Nothing is working.
Still all traffic form the wirequard-client-device gets logged as “Drop Forward” from “Green” Interface.
After all i read here in the forums i still don’t think that is how it is supposed to work. And i don’t see how i could create rules that allow exactly that one IP from the wireguard-IP-Range to be allowed specific traffic through the green interface.
Anyone has any ideas?
Mabye the only thing i didn’t try (that i can think of) up to now is to start all over again an reconfigure everything by hand - as that would be quite a mess.
That definitely shouldn’t be happening unless you have deliberately or accidentally created firewall rules to do that.
No additional firewall rules should be needed for using wireguard and doing that would only be trying to resolve the result of whatever is causing the problem rathger than fixing the root cause.
Without seeing the firewall rules you have in place it is difficult to identify what might be causing the problem and you might have some privacy or other issues with showing them.
Nothing was done in CU200 that would be expected to do what you have described and no other user has highlighted the same issue to date.
I would suggest that you create a backup and download it from the IPFire to the client that you are accessing the WUI from.
Then do a fresh install of CU200 and set up a wireguard connection and then test it out.
If that works correctly then do a restore of your backup and test the previous wireguard connection again and see if that now works.
If it works, then some problem occurred during the CU200 upgrade that corrupted something in the IPFire install.
If the same problem happens after the restore then that indicates that something in your previous setup is incorrect. Then you will need to do a fresh install and reconfigure everything from scratch.
If the wireguard connection setup before the restore also shows the same problem then we will need to look at the settings being used in your wireguard setup.
I’m running a default deny policy for outgoing connections, therefore i need to allow connections from any interface explicitly - and therefore also for the wireguard interface.
I already did that before the update and that worked fine, as i said.
Due to this default-deny-policy my concerns about posting firewall-rules is mainly the amount of rules, if i should post ALL of them.
I mainly used wireguard to have my phone route all traffic through the wireguard vpn if activated - for example in public wifi spots or something.
Therefore i create rules like these:
There are no explicit blocking rules or something.
Since the update, i can see that the wire-guard-tunnel itself is still working in general, as i can see the logfiles on the ipfire getting flushed immediately with things like these:
The funny thing about that is, that i even do not have a green interface. I bridged blue one of my LAN interfaces so, there is no interface for green.
I will follow your advice with the backup and a clean install to check if it occours there, too. But it might be next weekend before I can find the time for the test..
If you have somehow disabled the Green interface after installing then if it did work in the past then it could well be that some coding improvement/fix could have well stopped whatever you had working.
okay, maybe i was a bit short about that “funny part”.
I originally ran the setup with the GREEN, RED, ORANGE and BLUE config and assigned one LAN-interface to each of the first three zones and the wifi-interface to the blue one obviously..
Later on i changed the configuration in den WebUI > Zones. I set the blue Zone to “Bridge” and assigned the LAN-Interface from Green Zone to the Blue Zone.
As obviously one LAN-interface is not allowed to be assigned to two zones (and what is therefore rejected by the WebUI) i removed it from the green zone (what is accepted by the WebUI)
In the end i still have a green zone in my config, with an assigned adress range and so on. everywhere.
I just have no interface assigned to the green zone.
I will try reassigning the interface to the green zone this evening, if you still think that might cause the issue.
Thank you very much for the hint with the interface.
I reassigned the lan interface to GREEN and the wireguard connection is working as intended again and all traffic is logged as “wg0”.
And it’s reproducible.
If I active the bridge again, is again stops working.
Only WireGuard seems to have an issue with that configuration and getting logged every traffic as “Green0” instead of “wg0” in the bridged configuration.
OpenVPN-Connections worked well all the time and also everything else, except Wireguard.
So now I’ll need to find another solution for the original issue leading to the bridge-config But that might be another topic.
Yeah, but I don’t have another spare nic in my hardware, if i need to keep one in the green Zone.
In the last hour i wasn’t able to reconstruct the original reason for the bridge-setup… everything seems to work fine…
I pretty much assume there was something about getting my Ipfire work like “classic” internet routers (like AVMs or something) and only have one internal network for all my personal devices - for whatever didn’t work back then…
But that might be another topic.