* Question about ACL
@ 2021-03-09 12:29 wp1065151-spam wp1065151-spam
0 siblings, 0 replies; only message in thread
From: wp1065151-spam wp1065151-spam @ 2021-03-09 12:29 UTC (permalink / raw)
My Question :
I have two peers configured on my WG Server.
Peer A should grant access to Subnet 10.0.10.0/24
Peer B to 10.0.20.0/24.
In Clientconfig i set
AllowedIPs = 10.255.0.0/24,10.0.10.0/24
AllowedIPs = 10.255.0.0/24,10.0.20.0/24
Address = 10.9.254.1/24
ListenPort = 55555
PrivateKey = AAAAAAAAAAAAAAAAAAAA=
# PEER A
PublicKey = BBBBBBBBBBBBBBBBBBBB=
AllowedIPs = 10.9.254.100/32
# PEER B
PublicKey = CCCCCCCCCCCCCCCCCCC=
AllowedIPs = 10.9.254.101/32
How can i prevent PEER B from changing his config to :
AllowedIPs = 10.255.0.0/24,10.0.20.0/24,10.0.10.0/24
to get access to 10.0.10.0/24 too ?
If i add allowed IP in servers PEER B config, it will add a route for 10.0.10.0/24 to wg0
So PEER A is not longer be able to access this subnet.
How can i set a ACL that allows Peer A and Peer B only to access configured subnet, outside the client config.
I also could be happen that you would like allow your Friend only to access your Server (.101) and Printer (.150) but you Family the whole subnet.
Therefor Friend get in his peer Config:
AllowedIPs = 10.9.254.0/24,10.0.10.101/32,10.0.10.150/32
AllowedIPs = 10.9.254.0/24,10.0.10.0/24
How we prevent the Friend to change his config to 10.0.10.0/24 ?
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2021-03-09 21:08 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-09 12:29 Question about ACL wp1065151-spam wp1065151-spam
Development discussion of WireGuard
This inbox may be cloned and mirrored by anyone:
git clone --mirror http://inbox.vuxu.org/wireguard/0 wireguard/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 wireguard wireguard/ http://inbox.vuxu.org/wireguard \
Example config snippet for mirrors.
Newsgroup available over NNTP:
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git