Development discussion of WireGuard
 help / color / mirror / Atom feed
* Question about ACL
@ 2021-03-09 12:29 wp1065151-spam wp1065151-spam
  0 siblings, 0 replies; only message in thread
From: wp1065151-spam wp1065151-spam @ 2021-03-09 12:29 UTC (permalink / raw)
  To: wireguard

Hi.


My Question :
I have two peers configured on my WG Server.

Peer A should grant access to Subnet 10.0.10.0/24
Peer B to 10.0.20.0/24.

In Clientconfig i set 
PEER A
AllowedIPs = 10.255.0.0/24,10.0.10.0/24

PEER B
AllowedIPs = 10.255.0.0/24,10.0.20.0/24


SERVER
[Interface]
Address = 10.9.254.1/24
ListenPort = 55555
PrivateKey = AAAAAAAAAAAAAAAAAAAA=

[Peer]
# PEER A
PublicKey = BBBBBBBBBBBBBBBBBBBB=
AllowedIPs = 10.9.254.100/32

[Peer]
# PEER B
PublicKey = CCCCCCCCCCCCCCCCCCC=
AllowedIPs = 10.9.254.101/32


How can i prevent PEER B from changing his config to :
AllowedIPs = 10.255.0.0/24,10.0.20.0/24,10.0.10.0/24
to get access to 10.0.10.0/24 too ?

If i add allowed IP in servers PEER B config, it will add a route for 10.0.10.0/24 to wg0

So PEER A is not longer be able to access this subnet.

How can i set a ACL that allows Peer A and Peer B only to access configured subnet, outside the client config.

I also could be happen that you would like allow your Friend only to access your Server (.101) and Printer (.150) but you Family the whole subnet.
Therefor Friend get in his peer Config:
AllowedIPs = 10.9.254.0/24,10.0.10.101/32,10.0.10.150/32

Family:
AllowedIPs = 10.9.254.0/24,10.0.10.0/24

How we prevent the Friend to change his config to 10.0.10.0/24 ?

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2021-03-09 21:08 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-09 12:29 Question about ACL wp1065151-spam wp1065151-spam

Development discussion of WireGuard

This inbox may be cloned and mirrored by anyone:

	git clone --mirror http://inbox.vuxu.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ http://inbox.vuxu.org/wireguard \
		wireguard@lists.zx2c4.com
	public-inbox-index wireguard

Example config snippet for mirrors.
Newsgroup available over NNTP:
	nntp://inbox.vuxu.org/vuxu.archive.wireguard


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git