All of lore.kernel.org
 help / color / mirror / Atom feed
From: Bruno Wolff III <bruno@wolff.to>
To: wireguard@lists.zx2c4.com
Subject: crypto routing with subnets?
Date: Fri, 20 Oct 2017 12:39:41 -0500	[thread overview]
Message-ID: <20171020173941.GA23750@wolff.to> (raw)

I want to try to route a local network over wireguard through my router 
while not breaking a direct connection from my server while I'm testing 
the new setup. And I'm wondering if I'm going to need two wg devices or 
if I can use one?

On the destination the config would be something like:
[peer]
PublicKey = I37b0D0JbbBrSyH/oHjdMvL0P3m8kZQ5RiJ0Dha3ClU=
    Endpoint = 98.103.208.27:992
    AllowedIPs = 192.168.7.1/32
    PersistentKeepalive = 25
[peer]
PublicKey = I37b0D0JbbBrSyH/oHjdMvL0P3m8kZQ5RiJ0Dha3ClU=
    Endpoint = 98.103.208.26:992
    AllowedIPs = 192.168.0.0/16
    PersistentKeepalive = 25

It seems like this should work, though the public keys would be different 
in the real setup. (The second peer doesn't exist yet, so I can't use its 
public key in the example.)

So my main question is will traffic to 192.168.7.1 go to the first peer even 
though it is covered by the network in the second peer or do I need to 
make a wg0 and wg1 and do the routing at the interface level?

If I actually left the public keys the same, would this still work? (The 
securtity domain is nearly the same as the hardware is in the same place.) 
I don't think it could work as I think this would break tracking what IP 
address was last used by each peer.

Eventually I want to do something a bit more complicated, because I will only 
want devices that connected to my router with wireguard (i.e. my devices, 
not guests on my network) to be able to send packets over that tunnel. 
But for now traffic going through the tunnel doesn't get any access where I 
would be worried about guest traffic using the tunnel. At that time the server 
and router peer networks will be disjoint.

             reply	other threads:[~2017-10-20 17:47 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-10-20 17:39 Bruno Wolff III [this message]
2017-10-20 18:02 ` crypto routing with subnets? Jason A. Donenfeld
2017-10-20 18:06   ` Bruno Wolff III
2017-10-20 18:15     ` Jason A. Donenfeld

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171020173941.GA23750@wolff.to \
    --to=bruno@wolff.to \
    --cc=wireguard@lists.zx2c4.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.