Development discussion of WireGuard
 help / color / mirror / Atom feed
* Confused about AllowedIPs meaning?
@ 2020-07-26 10:57 Gunnar Niels
  2020-07-28 16:30 ` Lonnie Abelbeck
                   ` (2 more replies)
  0 siblings, 3 replies; 12+ messages in thread
From: Gunnar Niels @ 2020-07-26 10:57 UTC (permalink / raw)
  To: wireguard

Hello, I'm new to wireguard and have been experimenting with it in my home lab.
I'm interesting in using it to join two home networks (192.168.2.0/24 and
192.168.4.0/24). They're typical home networks in two physically different
locations, each with their own gateways to the internet. I'd like for the
machines on each network to use their default gateway for internet access, but
configure things so they use a simple linux machine (raspberry pi) to route
to the other subnet over wireguard is the destination is the opposite subnet.

One wireguard node is exposed via an endpoint with a dns A record (I'm port
forwarding to the internal machine). On the other subnet, the rpi node is behind
NAT and pointed to that endpoint.

I have been able to get the wireguard nodes to connect and route machines on
their opposite networks, but I haven't been able to get non-wireguard nodes
to communicate with non-wireguard nodes across the tunnel. I have a few questions
I'm trying to clear up:

* Is it true that there isn't really a notion of a server/client from wireguard's
perspective, they're really just nodes, and I've applied the semantic designation
of the node behind the endpoint as a server, and the node behind the NAT as the client?

* Here's my "server" config on 192.168.2.0/24:

===

[Interface]
Address = 10.2.0.1/24
ListenPort = 34777
PrivateKey = <server_priv_key>

[Peer]
PublicKey = <client_pub_key>
AllowedIPs = 10.2.0.2/32

===

Here's my "client" config on 192.168.4.0/24

===

[Interface]
Address = 10.2.0.2/24
PrivateKey = <client_priv_key>

[Peer]
PublicKey = <server_pub_key>
AllowedIPs = 0.0.0.0/0
Endpoint = <server_host>:34777
PersistentKeepalive = 15

===


The simplicity of the wireguard config is one of the best features about it,
but the only thing I'm unclear about here is: exactly what is the "AllowedIPs"
field configuring? I'm not sure how to configure these fields for my use-case.
I'm guessing the server configuration is explicitly whitelisting the client,
but I'm not sure what 0.0.0.0/24 on the clientside is saying. It feels like
I should have my subnets as part of this field, but I'm not sure where because
I'm not sure exactly what the field represents.

If someone could elaborate on it and point me in the right direction given my
objective, that would be much appreciated!

-GN


^ permalink raw reply	[flat|nested] 12+ messages in thread

end of thread, other threads:[~2020-07-31 14:19 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-26 10:57 Confused about AllowedIPs meaning? Gunnar Niels
2020-07-28 16:30 ` Lonnie Abelbeck
2020-07-28 21:12 ` Tomcsanyi, Domonkos
2020-07-28 21:33   ` Rich Brown
2020-07-29 16:11     ` M Rubon
2020-07-29 16:27       ` Gunnar Niels
2020-07-29 22:18     ` Ivan Labáth
2020-07-30  0:57       ` Rich Brown
2020-07-30 14:02         ` M Rubon
2020-07-30 18:08           ` Ivan Labáth
2020-07-30 21:03             ` Rich Brown
2020-07-29 10:40 ` John Sager

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).