OPNsense 24.7.6 Breaks WireGuard Split Tunnel Client

[stephendt]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Describe the bug

I have a highly odd issue with a Wireguard peer (client) connection from Opnsense to a remote site that has a WireGuard server. I have had this connection running fine for months, but suddenly yesterday it decided to stop connecting and shows "Peer disconnected" in the status page.

The only thing I can think of is that I rebooted it yesterday and possibly an update was applied as I do have automatic updates enabled. Other than that, no configuration changes, the VPN Server works fine with other devices. Any ideas? I have tried tweaking and reverting settings, performing all additional updates (currently on OPNsense 24.7.6), rebooted several times, no dice. Everything else seems to be working OK. Considering I have made zero Wireguard configuration changes, I believe there may be some sort of bug.

To Reproduce

Steps to reproduce the behavior:

1. Upgrade to OPNsense 24.7.6
2. WireGuard split tunnel is no longer functional.

Expected behavior

Wireguard split tunnels should connect without issue and not show a "peer disconnected" error.

Describe alternatives you considered

Restore a snapshot / backup to OPNsense 24.7.4_1. Solves issue immediately.

Relevant log files

/usr/local/opnsense/scripts/Wireguard/wg-service-control.php: ROUTING: not a valid opt2 interface gateway address: 'missing'

/usr/local/opnsense/scripts/Wireguard/wg-service-control.php: The command '/sbin/route add -'inet' '192.168.120.13' -interface 'wg1'' returned exit code '1', the output was 'add host 192.168.120.13: gateway wg1 fib 0: route already in table'

Additional context

No configuration changes were made before performing update. Split tunnel from OPNsense router to remote site with WireGuard server. Same client configuration is working on a Windows endpoint. All other OPNsense operations are OK with the exception of WireGuard tunnel.

Environment

Software version used and hardware type if relevant, e.g.:

OPNsense 24.7.6 (amd64).
Intel i5-7200u
Proxmox VM (VirtIO)