WireGuard Archive on lore.kernel.org
 help / color / Atom feed
From: "Tomcsanyi, Domonkos" <domi@tomcsanyi.net>
To: Gunnar Niels <gunnar.s.niels@gmail.com>
Cc: wireguard@lists.zx2c4.com
Subject: Re: Confused about AllowedIPs meaning?
Date: Tue, 28 Jul 2020 23:12:44 +0200
Message-ID: <26A86FD2-5A2D-49DC-A140-2E4B43213936@tomcsanyi.net> (raw)
In-Reply-To: <02830f08-9e6f-a9f1-54c3-43758e95758f@gmail.com>


> 2020. júl. 28. dátummal, 18:02 időpontban Gunnar Niels <gunnar.s.niels@gmail.com> írta:
> 
> Hello, I'm new to wireguard and have been experimenting with it in my home lab.
> I'm interesting in using it to join two home networks (192.168.2.0/24 and
> 192.168.4.0/24). They're typical home networks in two physically different
> locations, each with their own gateways to the internet. I'd like for the
> machines on each network to use their default gateway for internet access, but
> configure things so they use a simple linux machine (raspberry pi) to route
> to the other subnet over wireguard is the destination is the opposite subnet.
> 
> One wireguard node is exposed via an endpoint with a dns A record (I'm port
> forwarding to the internal machine). On the other subnet, the rpi node is behind
> NAT and pointed to that endpoint.
> 
> I have been able to get the wireguard nodes to connect and route machines on
> their opposite networks, but I haven't been able to get non-wireguard nodes
> to communicate with non-wireguard nodes across the tunnel. I have a few questions
> I'm trying to clear up:
> 
> * Is it true that there isn't really a notion of a server/client from wireguard's
> perspective, they're really just nodes, and I've applied the semantic designation
> of the node behind the endpoint as a server, and the node behind the NAT as the client?
> 
> * Here's my "server" config on 192.168.2.0/24:
> 
> ===
> 
> [Interface]
> Address = 10.2.0.1/24
> ListenPort = 34777
> PrivateKey = <server_priv_key>
> 
> [Peer]
> PublicKey = <client_pub_key>
> AllowedIPs = 10.2.0.2/32
> 
> ===
> 
> Here's my "client" config on 192.168.4.0/24
> 
> ===
> 
> [Interface]
> Address = 10.2.0.2/24
> PrivateKey = <client_priv_key>
> 
> [Peer]
> PublicKey = <server_pub_key>
> AllowedIPs = 0.0.0.0/0
> Endpoint = <server_host>:34777
> PersistentKeepalive = 15
> 
> ===
> 
> 
> The simplicity of the wireguard config is one of the best features about it,
> but the only thing I'm unclear about here is: exactly what is the "AllowedIPs"
> field configuring? I'm not sure how to configure these fields for my use-case.
> I'm guessing the server configuration is explicitly whitelisting the client,
> but I'm not sure what 0.0.0.0/24 on the clientside is saying. It feels like
> I should have my subnets as part of this field, but I'm not sure where because
> I'm not sure exactly what the field represents.
> 
> If someone could elaborate on it and point me in the right direction given my
> objective, that would be much appreciated!
> 
> -GN


I think mainly you need to decide whether you want to just route the traffic between the two networks or you want to use NAT as well.
In case you are just routing then you’d need at minimum the range of the other network, because after decrypting the source IP will be from that range. Otoh if you are using NAT you can just use an arbitrary IP address inbetween the two tunnel endpoints, because the traffic will be modified, just like when you go out to the interner via a router.
Also don’t forget to add the respective routes to either the local default gw or each host in case you are not using NAT - otherwise you won’t get any of the answers.
I hope this helped.

Cheers
Domi

  parent reply index

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-26 10:57 Gunnar Niels
2020-07-28 16:30 ` Lonnie Abelbeck
2020-07-28 21:12 ` Tomcsanyi, Domonkos [this message]
2020-07-28 21:33   ` Rich Brown
2020-07-29 16:11     ` M Rubon
2020-07-29 16:27       ` Gunnar Niels
2020-07-29 22:18     ` Ivan Labáth
2020-07-30  0:57       ` Rich Brown
2020-07-30 14:02         ` M Rubon
2020-07-30 18:08           ` Ivan Labáth
2020-07-30 21:03             ` Rich Brown
2020-07-29 10:40 ` John Sager

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=26A86FD2-5A2D-49DC-A140-2E4B43213936@tomcsanyi.net \
    --to=domi@tomcsanyi.net \
    --cc=gunnar.s.niels@gmail.com \
    --cc=wireguard@lists.zx2c4.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

WireGuard Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ https://lore.kernel.org/wireguard \
		wireguard@lists.zx2c4.com
	public-inbox-index wireguard

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/com.zx2c4.lists.wireguard


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git