Client install, multi-wg server:Ĭlient one will connect to the server’s wg0, and client two will connect to the server’s wg1. systemctl enable systemctl enable systemctl start systemctl start done. Now enable both interfaces, and bring them online. Set up your server with two WireGuard interfaces: touch chmod 600 wg genkey > /etc/wireguard/keys/ wg pubkey touch chmod 600 wg genkey > /etc/wireguard/keys/ wg pubkey /etc/wireguard/keys/ĭon’t forget to make sure ipv4 forwarding is enabled on your server: sed -i 's/^#net\.ipv4\.ip_forward=1/_forward=1/' sysctl -p
This also works for passing traffic between WireGuard clients on the same interface – the trick is in making certain that AllowedIPs in the client configs includes the entire IP subnet services by the server, not just the single IP address of the server itself (with a /32 subnet)… and that you not only set up the tunnel on each client, but initialize it with a bit of data as well.
But once you grok how it works, well, it works. It gets a bit tricky when you want packets to route between WireGuard clients. But then you look at your LAN rules-and they’re default allow! WTF?Īha! This was the last piece I was really looking for with WireGuard.
If you try something nice and obnoxious like nmap that will constantly try to open connections, you’ll see tons of red as the connections from your remote machine are blocked, using Default Deny. WTF?ĭiagnostically, you can go in the OpnSense GUI to Firewall–>Log Files–>Live View. If you try nmap from the remote client, it shows all ports filtered. Natch.Īt this point, if you connect into the network over your VPN, your remote client will be able to successfully ping machines on the LAN… but not access any services. Gateway is the new gateway you just created. Network Address is the subnet of your tunnels-in our example, 10.8.0.0/24. Now you create a static route, in System–>Routes–>Configuration. Add a gateway with your VPN server’s LAN IP address, name it, done. In OpnSense, that’s System–>Gateways–>Single. You port forwarded the VPN service port to that box, which was easy enough, under Firewall–>NAT–>Port Forward.īut now you need to set a static route through that LAN-located gateway machine, so that all the machines on the LAN can find it to respond to requests from the tunnel-eg, 10.8.0.0/24.įirst step, in either OpnSense or pfSense, is to set up an additional gateway. You’ve got a server on the LAN running OpenVPN, WireGuard, or some other VPN service.
0 kommentar(er)
