Getting wg(4) NetBSD server to work with WireGuard(R) macOS client

[Paul W. Rankin <rnkn%rnkn.xyz@localhost>]

Hello,

I'm trying to get a wg(4) NetBSD server to work with a WireGuard(R)
macOS client. I have succeeded in getting a handshake and can send
bytes, but I don't receive bytes via ping or in Firefox. Meanwhile,
mosh works fine.

Here's my step-by-step:

On the NetBSD server:

	# (umask 0077; wg-keygen > /etc/wg0)
	# wg-keygen --pub < /etc/wg/wg0 > /etc/wg/wg0.pub
	# cat /etc/wg0.pub
	1WaiYse6arup/pNqos7CyvtsTm6O8PN+/s/6UZdk0kc=

	# ifconfig wg0 create
	# ifconfig wg0 inet 10.2.0.1/24

	[sever has no ipv6]

	# wgconfig wg0 set private-key /etc/wg0
	# wgconfig wg0 set listen-port 9443
	# wgconfig wg0 add peer sevastopol \
		1WaiYse6arup/pNqos7CyvtsTm6O8PN+/s/6UZdk0kc= \
		--allowed-ips=10.2.0.42/32

	# ifconfig wg0 down
	# ifconfig wg0 up
	# ifconfig wg0
	wg0: flags=0x8041<UP,RUNNING,MULTICAST> mtu 1420                               
        	status: active
	        inet6 fe80::1457:1bc8:34cf:69c0%wg0/64 flags 0 scopeid 0x3
	        inet 10.2.0.1/24 flags 0

On the hosting service firewall:

	accept	UDP	9443	0.0.0.0/0
	accept	UDP	51820 	0.0.0.0/0

On the macOS WireGuard(R) client:

	Name = sevastopol
	PublicKey = 8Oe88+HZAJ39RePuIcw3OQjQtC+onX0/lXk2rxC9HUw=

	[Interface]
	PrivateKey = [*** redacted ***]
	Address = 10.2.0.42/24

	[Peer]
	PublicKey = 1WaiYse6arup/pNqos7CyvtsTm6O8PN+/s/6UZdk0kc=
	AllowedIPs = 1.0.0.0/8, 2.0.0.0/8, 3.0.0.0/8, 4.0.0.0/6, 8.0.0.0/7,
	11.0.0.0/8, 12.0.0.0/6, 16.0.0.0/4, 32.0.0.0/3, 64.0.0.0/2,
	128.0.0.0/3, 160.0.0.0/5, 168.0.0.0/6, 172.0.0.0/12, 172.32.0.0/11,
	172.64.0.0/10, 172.128.0.0/9, 173.0.0.0/8, 174.0.0.0/7, 176.0.0.0/4,
	192.0.0.0/9, 192.128.0.0/11, 192.160.0.0/13, 192.169.0.0/16,
	192.170.0.0/15, 192.172.0.0/14, 192.176.0.0/12, 192.192.0.0/10,
	193.0.0.0/8, 194.0.0.0/7, 196.0.0.0/6, 200.0.0.0/5, 208.0.0.0/4
	Endpoint = starbeastie.rnkn.xyz:9443

	$ ping -c5 10.2.0.1
	PING 10.2.0.1 (10.2.0.1): 56 data bytes
	Request timeout for icmp_seq 0
	Request timeout for icmp_seq 1
	Request timeout for icmp_seq 2
	Request timeout for icmp_seq 3

	--- 10.2.0.1 ping statistics ---
	5 packets transmitted, 0 packets received, 100.0% packet loss

Back on the NetBSD server:

	# wgconfig wg0
	interface: wg0
	        private-key: (hidden)
	        listen-port: 9443
	        peer: sevastopol
	                public-key: 8Oe88+HZAJ39RePuIcw3OQjQtC+onX0/lXk2rxC9HUw=
	                endpoint: 1.146.105.131:1085
                	preshared-key: (hidden)
        	        allowed-ips: 10.2.0.42/32
	                latest-handshake: Sat Jan 11 13:40:49 2025

What am I doing wrong here?

Thanks in advance,

-- 
Paul W. Rankin
https://rnkn.xyz