Separate Client VPN Connections from Site Connections

[spetrillo]

Hello all,

Both my client and site VPN connections use the same subnet. This causes an issue when I implement an outbound NAT to the Internet, for the WG interface. The site VPN connection stays up but routing is all messed up. Do you separate client and site connections by subnet? I was using a /24 for all connections, so I guess I could subnet the client from the site connections, but this will also impact site connections since its applied to the interface. How do ppl segregate client from site connections, so you can apply the outbound rule?

Thanks,
Steve

[bartjsmit]

I use a /21 for the internal network and slice /24 subnets off that

[spetrillo]

That makes sense. Do you use 0.0.0.0/0 for AllowedIPs?

[bartjsmit]

yes, it makes testing from the LAN easier

[spetrillo]

That worked well...now how about allowing local IPs? Do I add those subnets to the AllowedIPs or is it just subnets behind the VPN?