7

Following is what I want to achieve. Could someone suggest a solution with specific steps? If the requirement cannot be satisfied with Wireguard what would be an alternate solution?

Routers on both the sites (R-A and R-B) have static public (WAN) IP addresses and a domain name. There is a Wireguard server running on each site.
All the devices on both sites have static LAN addresses.
Some of the devices do not have the capabilities to support Wireguard Client to connect to the Wireguard Server.
Both the sites have the same local network (192.168.1.0/24).
Both routers have different DHCP ranges. And most of the devices are on static LAN addresses.

Requirement:

When both the Wireguard servers are up and running. Can I connect each server to the other Wireguard server as a Wireguard client so I can connect both the sites?
When both the sites are connected with Wireguard, Can I access site A devices from site B or vice versa?
If I can connect to any of the Wireguard servers from an external Wireguard client, Can I access the devices on both sites?

enter image description here

Improve this question
1
  • Same as my comment here, you will have to renumber one of the networks. I recommend changing Site B network from 192.168.1.0/24 to 192.168.2.0/24. Also, this script wireguard-site-to-site.sh might help you with the Wireguard config and iptables rules. I explained that linked script in this longer Answer. Great visual diagram!
    – JamesThomasMoon
    Commented Nov 2, 2022 at 3:47

2 Answers 2

Reset to default
7

Both the sites have the same local network (192.168.1.0/24).

This is a problem -- if you have 192.168.1.2 (say Device A1) in Site A wanting to connect to 192.168.1.3 (say Device B1) in Site B, 192.168.1.2 will think 192.168.1.3 is on its own local network and can connect to it directly (whereas it actually needs to route through the WireGuard servers). You need to rearrange your subnets so that they don't collide -- for example, use 192.168.1.0/25 for Site A and 192.168.1.128/25 for Site B.

When both the WireGuard servers are up and running, can I connect each server to the other WireGuard server as a WireGuard client so I can connect both the sites?

Yes -- technically WireGuard doesn't have distinct "server" or "client" roles -- both sides are equally capable of sending/receiving/routing traffic from the other.

When both the sites are connected with WireGuard, can I access Site A devices from Site B or vice versa?

Yes -- provided you fix the routing problem of both sites using the same local network of 192.168.1.0/24. Once you do that, you just have to:

  1. configure the router in each site to route packets for the other site through the site's own WireGuard server; and
  2. configure each site's WireGuard server to route packets for the other site through the other site's WireGuard server.

For example, say you use 192.168.1.0/25 for Site A and 192.168.1.128/25 for Site B; and assign 192.168.1.2 to Device A1 and 192.168.1.130 to Device B1; and assign 192.168.1.10 to WireGuard Server 1 and 192.168.1.140 to WireGuard Server 2. For Site A you'd:

  1. configure Router R-A to route 192.168.1.128/25 (Site B LAN) via 192.168.1.10 (WireGuard Server 1)
  2. configure WireGuard Server 1 to route 192.168.1.128/25 (Site B LAN) via its WireGuard interface to WireGuard Server 2 -- WireGuard will do this automatically for you if set AllowedIPs = 192.168.1.128/25 in the [Peer] section for WireGuard Server 2 in the WireGuard config on WireGuard Server 1

And correspondingly, for Site B you'd:

  1. configure Router R-B to route 192.168.1.0/25 (Site A LAN) via 192.168.1.140 (WireGuard Server 2)
  2. configure WireGuard Server 2 to route 192.168.1.0/25 (Site A LAN) via its WireGuard interface to WireGuard Server 1 -- WireGuard will do this automatically for you if set AllowedIPs = 192.168.1.0/25 in the [Peer] section for WireGuard Server 1 in the WireGuard config on WireGuard Server 2

With that it place, when Device A1 (192.168.1.2) tries to connect to Device B1 (192.168.1.130), it sends those packets to Router R-A, which forwards them to WireGuard Server 1, which forwards them through the WireGuard tunnel to WireGuard Server 2, which forwards them to Device B1. When Device B1 sends packets back to Device A1, it sends those packets to Router R-B, which forwards them to WireGuard Server 2, which forwards them through the WireGuard tunnel to WireGuard Server 1, which forwards them to Device A1.

This site-to-site configuration tutorial walks through a complete example of this scenario.

If I can connect to any of the WireGuard servers from an external WireGuard client, can I access the devices on both sites?

Yes (again provided you fix the routing problem of both sites using the same local network of 192.168.1.0/24). I would suggest using a separate WireGuard interface on your WireGuard servers for external clients, to make it easy to apply different routing and firewall rules for those clients. You might use wg0 for the site-to-site connection, and wg1 for the point-to-site (external client) connections.

In order to route packets from the external clients within each site, you can either have the WireGuard servers SNAT (aka masquerade) the packets, so that the source address of each packet is rewritten to the LAN address of the WireGuard server to which the external client is connected; or simply configure each site's router with routes for the external WireGuard networks themselves.

This point-to-site configuration tutorial walks through an example of a scenario where you use SNAT/masquerading; but for your scenario, it'd probably be more straightforward to just add routes to your routers for the external WireGuard networks, like:

  1. configure the router in each site to route packets for both external WireGuard networks through the site's own WireGuard server; and
  2. configure the site's WireGuard server to route packets for the other site's external WireGuard network through its WireGuard connection to the other site; and
  3. configure each external WireGuard client to route packets for both sites through the WireGuard server to which it's connected

For example, say you've set up a site-to-site connection as described above, connecting Site A (192.168.1.0/25) with Site B (192.168.1.128/25) through WireGuard Server 1 and WireGuard Server 2. Now you're going to use the 10.0.1.0/24 subnet for the WireGuard network of external clients that connect to WireGuard Server 1, and the 10.0.2.0/24 subnet for the WireGuard network of external clients that connect to WireGuard Server 2. (Those subnets are completely arbitrary -- you can choose whatever you want, as long as they don't collide with any of your other internal networks.)

For Site A you'd:

  1. configure Router R-A to also route 10.0.1.0/24 and 10.0.2.0/24 via 192.168.1.10 (WireGuard Server 1)
  2. configure WireGuard Server 1 to route 10.0.2.0/24 via its WireGuard interface to WireGuard Server 2 -- do this by setting AllowedIPs = 192.168.1.128/25, 10.0.2.0/24 in the [Peer] section for WireGuard Server 2 in the WireGuard config on WireGuard Server 1
  3. configure each external client of WireGuard Server 1 to route 192.168.1.0/25 and 192.168.1.128/25 via its WireGuard interface to WireGuard Server 1 -- do this by setting AllowedIPs = 192.168.1.0/25, 192.168.1.128/25 in the [Peer] section for WireGuard Server 1 in the WireGuard config of the external client (or in this case, since together both subnets add up to 192.168.1.0/24, you could simply set AllowedIPs = 192.168.1.0/24).

And correspondingly, for Site B, you'd:

  1. configure Router R-B to also route 10.0.1.0/24 and 10.0.2.0/24 via 192.168.1.140 (WireGuard Server 2)
  2. configure WireGuard Server 2 to route 10.0.1.0/24 via its WireGuard interface to WireGuard Server 1 -- do this by setting AllowedIPs = 192.168.1.0/25, 10.0.1.0/24 in the [Peer] section for WireGuard Server 1 in the WireGuard config on WireGuard Server 2
  3. configure each external client of WireGuard Server 2 to route 192.168.1.0/25 and 192.168.1.128/25 via its WireGuard interface to WireGuard Server 2 -- do this by setting AllowedIPs = 192.168.1.0/25, 192.168.1.128/25 in the [Peer] section for WireGuard Server 2 in the WireGuard config of the external client (or in this case, since together both subnets add up to 192.168.1.0/24, you could simply set AllowedIPs = 192.168.1.0/24).

For each external client of WireGuard Server 1, you'd choose an IP address from the 10.0.1.0/24 subnet for the external client. For example, say you chose 10.0.1.100 for external client WC. You'd set Address = 10.0.1.100/32 in the [Interface] section of the WireGuard config for the interface of this client that connects to WireGuard Server 1. And you'd set AllowedIPs = 10.0.1.100/32 in the [Peer] section for the client in the WireGuard config on WireGuard Server 1.

With that it place, when external client WC (10.0.1.100) tries to connect to Device B1 (192.168.1.130), it sends those packets through the external WireGuard tunnel to WireGuard Server 1, which forwards them through the site-to-site WireGuard tunnel to WireGuard Server 2, which forwards them to Device B1. When Device B1 sends packets back to external client WC, it sends those packets to Router R-B, which forwards them to WireGuard Server 2, which forwards them through the site-to-site WireGuard tunnel to WireGuard Server 1, which forwards them through the external WireGuard tunnel to external client WC.

Improve this answer
1
  • Imo, this answer should have been accepted by the requester as the correct answer. The requester should at least have taken the time to acknowledge the answer and either accepted it or indicated why it did not provide a valid solution to the question. As for myself, this provided me with a very useful summary of details that I otherwise would have had to dig and test for myself through a much longer process. Thanks @Justin Ludwig for your time in writing this high-quality answer.
    – mesr
    Commented Feb 20 at 18:35
1

It would be easier if you could have your two networks on two different sub network address space (for example: 192.168.0.0/24 and 192.168.1.0/24). In that way you can make routes on the networks to use wireguard gateway as the default gateway for another network. With both networks on the same subnetwork, routing is more difficult to setup. You would need a netmask longer than 24 bits.

I have done exactly what you want to achieve, but I have subnetworks on different address spaces. Therefore, my routing was a bit simpler. However, it does not mean, that it cannot be done. You may need some IP changes for routing to work. Take a look here: Wireguard connection between to LANs with wireguard boxes behind routers

If you have additional questions, ask.

Improve this answer
7
  • I tried to follow this as well, but get confused with the Wireguard setup. We have 2 servers, and at the same time they are each other's clients? So in the configs you specify the endpoint to each other or how does that work exactly?
    – miccet
    Commented Mar 14, 2021 at 20:21
  • 1
    Oh, I see. There is an error in the post from the link. One computer running wireguard is a server and the other is a client. The difference in wireguard configuration is that the client has an Endpoint defined in [Peer] section, while the server does not. It is corrected now.
    – nobody
    Commented Mar 15, 2021 at 6:14
  • Makes sense, thanks for answering! I will have to install a custom dhcp server like you explained below that since one of my routers doesn't allow setting static routes on the LAN. Debating with myself if I want to do that on the network I have no physical access to for a while :)
    – miccet
    Commented Mar 15, 2021 at 15:22
  • @miccet I have had exactly the same dillema. One of the routers supported setting static routes, while the distant one did not. Anyway, now when it works, I am glad I did it, and I have more control. I also messed it up once, and had to wait for some time to get someone to a distant location and switch on DHCP on router temporarily, until I fixed it. Then my ISP upgraded the router that supported static routes, and that functionality broke. I am still waiting for them to fix it. :(
    – nobody
    Commented Mar 16, 2021 at 6:18
  • aw that sucks. also, it feels much cleaner if the router can just handle the static routes part. i got it all working now thanks to your guide. i didn't take the step yet with the static route on the remote LAN and it seems i don't have to. the services i want to reach are all on the other LAN where i'm not at and having the static route on this end seems to be enough for that. i thought you needed the static routes on both ends to get an answer at all, but it seems to work as long as you can reach them from here initially. big thanks for your guide!
    – miccet
    Commented Mar 16, 2021 at 21:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .