Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

os-wireguard rejects new tunnel definition with duplicate key message #4523

Open
noci2012 opened this issue Feb 3, 2025 · 4 comments
Open
Labels
support Community support

Comments

@noci2012
Copy link

noci2012 commented Feb 3, 2025

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

Describe the bug
Setup: Some endpoints get a choice to either connect to internal LAN or public LAN or IOT LAN from outside.
the OpnSense fw has wg1, wg2, wg3 for this.
The endpoints have a single PrivateKey. this is no problem on a different linux (and on a previous firewall[ also linux based]).
The keys need to be unique per interface.
Currently the web interface does not take the interface into consideration when checking for duplicate keys.

To Reproduce
Steps to reproduce the behavior:

  1. goto VPN/Wireguard/peers/wg1
  2. add a client
  3. goto VPN/Wireguard/peers/wg2
  4. add a client with the same public key.
  5. See error
    Expected behavior
    Only display the editor within the same interface. (no new device with duplicate key on wg1 when adding on wg1).

Screenshots
N/A

Relevant log files
N/A

Additional context
It is an oversight.

Environment
OpnSense 24.7 (24.7.12_4)

@fichtner
Copy link
Member

fichtner commented Feb 3, 2025

If this is the initial 24.7 you may want to grab an update first.

@fichtner fichtner added the support Community support label Feb 3, 2025
@noci2012
Copy link
Author

noci2012 commented Feb 3, 2025

This is a last update for 24.7 (24.7.12_4) I upgraded to that one to test for updates on this.
There is a good reason for this check for a single interface. The requirement does not extend to a different wireguard interface.

@fichtner
Copy link
Member

fichtner commented Feb 3, 2025

Thanks for the clarification.

@noci2012
Copy link
Author

noci2012 commented Feb 3, 2025

(BTW, this condition exists as entries are created outside of OpnSense and added to OpnSense firewall.
Peer generator is not used.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
support Community support
Development

No branches or pull requests

2 participants