Bug #13047
closed
Firewall rules on WireGuard interfaces ignored, state counters not updating and always show 0/0
Added by Adam Goldberg over 2 years ago.
Updated over 2 years ago.
Description
Firewall rules added to "WireGuard" are processed, but rules added to specific interfaces are ignored.
This issue is repeatable and has been tested on 4 machines each running PfSense Plus 22.02 and the latest WireGuard package (0.1.6_1)
Files
- Status changed from New to Not a Bug
Group rules (such as the WireGuard tab) are processed before per-interface rules. Assigned WireGuard interfaces are still members of the group, so there is no opportunity to match the interface rules so long as the packet matches a group rule.
Disable the group rule or scope it better so that it does not match the addresses on the assigned WireGuard interface and then it will match the interface rule(s).
This likely needs to be re-opened. Even with the group rule removed and also disabled, interface rules are ignored.
I can't reproduce that here on snapshots. I have no group rules, only rules on assigned WG interfaces. Traffic passes exactly as expected and there is data on the counters.
Thanks, just tested on snapshots and I can confirm this works as expected on 22.05 snapshots. It does not appear to work on 22.02
Also available in: Atom
PDF