How to solve routing in wireguard site-to-site network

bake_betty

I have set up a site-to-site network with wireguard: wg-server <-network A-> router A <--internet--> router B <-network B-> wg-client AND host B1, B2 etc wg-server is running some network services like http, ssh etc. The goal is to access services at wg-server from host B1. The wireguard connection between wg-client and wg-server works: I can access the hosts from each other. Also I can reach router A from wg-client, but not from host B1....

Originally asked by jofland on Stack Exchange (superuser) (CC BY-SA 4.0).

uphilltech

Great question — answering as the UphillTech team:

The 192.168.76.44 host and alike need to have route on themselves that route traffics for 10.8.0.0/24 (well or just 10.8.0.1 in your case) via 192.168.76.30 . Without such route they will route the traffics via their default gateway (i.e. 192.168.76.1 / router B), which will forward the traffics over to its WAN (its firewall might drop them because the IP belongs to a private block as well). Alternatives of adding the required route on each the LAN hosts (that wants the connectivity to the WG network / server) are adding the route on router B instead, or set up SNAT (IP masquerade) on the WG client for traffics with source IP within 10.8.0.0/24 / being 10.8.0.1 (that destined at...

Full answer by Tom Yan: https://superuser.stackexchange.com/a/1745609 (CC BY-SA 4.0).

Need it done for your business? UphillTech.