OPNSense site2site almost working

I am trying to create a site2site powered by zerotier between 2 opnsense firewalls. One is hosted on a vps with a static ip and the other is my local firewall on my lan, behind a comcast dynamic ip. By setting (subnet with vms with services) as a managed route through (local firewall’s zerotier ip), I am able to get (static ip firewall) to ping and access services on However, when I try to actually forward a port to, it times out because (as far as I can tell) public ips get lost en route between the two firewalls. What should I do?

what I can tell:
local firewall correctly routes public ip addresses to the remote firewall
remote firewall can receive pings from
anything with a public ip destination never gets to the remote firewall because nothing is getting logged as blocked or otherwise

Here is what I can see from
it can ping
it gets correctly routed to
it can’t ping
it gets halfway to on the route


You want to be your exit to the internet? You might need to enable masquerade or SNAT on that router.

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.