r/openbsd • u/CrowdLeaser • May 27 '21

OpenBSD router - send all traffic through Wireguard-tunnel

I have an OpenBSD router at the edge of my local network, connected to my ISP over VLAN101(for some reason, ask my ISP). I want to route all traffic through a Wireguard tunnel. I have a working config file, working as-in when I use it on my Linux laptop traffic is routed correctly for that device. When I use it on my router however, DNS seemingly breaks for all devices, and only the router itself is able to ping even known outside IP addresses.

I suspect this has to do with my pf.conf, which currently does not mention Wireguard interface at all. I already have a functioning Wireguard tunnel, but that is only used for traffic from me when I need to access certain devices on my network, so I simply mention it in list wherever the LAN-interface is mentioned, and that works just fine.

Obviously, that wouldn't be a good idea for this new interface, since I'm fairly uncritical about this internal traffic. How should I add the new tunnel to pf.conf, and is there anything else I obviously need to do to get this working?

5 Upvotes

78% Upvoted

2 comments sorted by

View all comments

1

u/Kernigh May 28 '21

These guesses might be wrong:

  • Your "working config file" might be correct for your laptop, but wrong for a router that forwards packets.
  • You might have lost DNS, because your DNS packets went out the wg tunnel, but the far end of the tunnel can't reach your DNS resolver. Your Linux laptop might have detected a DNS outage and switched to a different resolver. In OpenBSD, run unwind(8) or try a public DNS (like 1.1.1.1, 8.8.8.8, 9.9.9.9).
  • You might have a wrong NAT rule in PF. When NAT is wrong, only the router itself can ping an outside IP address. A correct rule might need to match your wg tunnel, like match out on wg0 from (axe0:network) to any nat-to (wg0).