Print Page - WireGuard Site-to-Site Setup with far-end break-out

Title: WireGuard Site-to-Site Setup with far-end break-out
Post by: MoonbeamFrame on June 30, 2023, 01:45:53 AM

I have no problem in getting the Site-to-Site traffic passing.

But I'm having limited success on doing the far-end break-out, currently it is working from A to B, but not B to A.

I have not found anything in the forum, so could someone point me to any documentation that might help?

Thank you.

Title: Re: WireGuard Site-to-Site Setup with far-end break-out
Post by: Monviech (Cedrik) on June 30, 2023, 09:28:32 AM

Could you provide a network diagram of what you try to do?

Title: Re: WireGuard Site-to-Site Setup with far-end break-out
Post by: MoonbeamFrame on July 01, 2023, 09:04:43 AM

Simplified diagram attached.

We have

- vlans A1 and B1 exchanging traffic
- vlans A2 and B2 isolated from each other
- vlan A1 able to use WAN B

I'm trying to get vlan B1 to be able to use WAN A

Site A is running OPNsense (my end). Site B is running Linux iptables.

At site A traffic from site B can be seen routing out via WAN A, but site B does not see the return traffic.

Title: Re: WireGuard Site-to-Site Setup with far-end break-out
Post by: Monviech (Cedrik) on July 03, 2023, 08:50:21 AM

Does the wireguard tunnel config on both sides include:

Code Select


[Peer]
AllowedIPs = 0.0.0.0/0

Otherwise the wireguard tunnel drops packets with a public IPv4 address as destination.

I would use this tutorial to create a wireguard tunnel as a gateway: https://docs.opnsense.org/manual/how-tos/wireguard-selective-routing.html

Title: Re: WireGuard Site-to-Site Setup with far-end break-out
Post by: MoonbeamFrame on July 03, 2023, 11:01:24 AM

Thanks.

0.0.0.0/0 Already set

And that was the tutorial I used when configuring the tunnel.

OPNsense Forum

English Forums => Virtual private networks => Topic started by: MoonbeamFrame on June 30, 2023, 01:45:53 AM