How to make WireGuard Firewall settings "stick"?

[Kermee]

Hi All,

I have a site-to-site WireGuard tunnel setup between a GL-AR750S Slate and an Netgate SG-3100 running pfSense 21.02 (pfSense 2.5.0) which now has support for WireGuard. Everything runs great, but I have to always switch two things on the Slate when the WireGuard client comes up. I’m sure it’s handled by the /etc/init.d/wireguard script, but alas, need a bit of help.

When the WireGuard client tunnel is brought up, it looks like this where the INPUT on the wireguard zone is set to DROP and Masquerading is turned ON:

I have to manually change the INPUT to ACCEPT and turn Masquerading OFF:

Here are the relevant iptable changes I need to make:

Any help on where I can make the changes so it persists, would be greatly appreciated. Thanks in advance.

[Kermee]

UPDATE: I went this route instead of using the GL GUI.

Wireguard with split tunnel

I solved my issue, but could not do that via the GL gui. I’ll give my solution here, as others might look for the same. Go to “MORE SETTINGS” → “Advanced” and log in Hover over “System” and go to “Software” Search for “luci-proto-wireguard” and klick “install” Hover over “Network” and go to “Interfaces” “Add new interface…” Choose a name for the Interface Select “WireGuard VPN” as protocol Make WireGuard Settings like in the GL gui As allowed IPs choose the Range of the remote network and add…

It resolved my issues.