WireGuard Archive on lore.kernel.org
 help / color / Atom feed
From: Bruno Wolff III <bruno@wolff.to>
To: Germano Massullo <germano.massullo@gmail.com>
Cc: WireGuard mailing list <wireguard@lists.zx2c4.com>
Subject: Re: WireGuard connecting hosts WAN->LAN
Date: Wed, 18 Mar 2020 16:50:26 -0500
Message-ID: <20200318215026.GA5996@wolff.to> (raw)
In-Reply-To: <c3b5c2e5-d77b-1984-107d-6f6a56b67f84@gmail.com>

On Sat, Mar 14, 2020 at 16:33:44 +0100,
  Germano Massullo <germano.massullo@gmail.com> wrote:
>A simple question to Wireguard developers, since while asking for help
>in OpenWRT forum[1] I have been told that I am asking a thing that
>Wireguard cannot do, so I want to ask upstream if it is possible or not
>
>Scenario:
>A = internet (WAN) host (WireGuard IP 10.1.1.3)
>B = OpenWRT router (WireGuard IP 10.1.1.1)
>C = LAN host (WireGuard IP 10.1.1.2)
>
>I want to:
>1) connect A to C passing through B. I don't want to expose C to
>internet at all, (so no things like port forwarding)
>2) A must have C public key (and viceversa), so in case of B being
>compromised, the A<->C VPN will not be compromised.
>
>In a few words, I want B to just route forwards packages from A to C.

This set of requirements seems odd.
Do you not trust C to be able to properly ignore unwanted packets?

It is possible to have C ignore layer 3 traffic (DHCP traffic is special) 
that is not using the tunnel. Inbound you block all traffic not 
destined for the tunnel's port. Outbound you block all traffic not 
tagged as tunnel traffic. (Wireguard provides a way to tag tunnel traffic.) 
The default route should be through the tunnel. Tunnel traffic should be 
routed through B. The configuration gets trickier if you want to send 
traffic to A's external address as then you have a routing dependency not 
based on the destination address. You can do this by having two routing 
tables using the tag to pick which table gets used.

      parent reply index

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-03-14 15:33 Germano Massullo
2020-03-14 18:16 ` Luis Ressel
2020-03-14 20:43   ` Germano Massullo
2020-03-14 19:56 ` Kent Friis
2020-03-18 21:50 ` Bruno Wolff III [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200318215026.GA5996@wolff.to \
    --to=bruno@wolff.to \
    --cc=germano.massullo@gmail.com \
    --cc=wireguard@lists.zx2c4.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

WireGuard Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ https://lore.kernel.org/wireguard \
		wireguard@lists.zx2c4.com
	public-inbox-index wireguard

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/com.zx2c4.lists.wireguard


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git