6

BACKGROUND:
I have configured a Wireguard VPN server on my local (private) network. [Say private network: 192.168.1.0/24] Wireguard clients have the same IP network 192.168.1.X

There are some non-Wireguard compatible devices (IP cameras, DVRs) in my network with static local IP addresses.

QUERY:
When I connect to the Wireguard server (from outside my local network) as a Wireguard client, I want to access those non-Wireguard compatible devices with their local static IP address. I have made sure that there won't b any IP conflicts.

Lalit Jadhav
  • 61
  • 1
  • 1
  • 2

1 Answers1

8

When you want to connect individual external hosts to a LAN via WireGuard, the three key things you need to do are:

  1. Include the LAN's IP block (or at least the IP address of each individual LAN-side host you want to access) in the AllowedIPs setting of the WireGuard config on each external host
  2. Set up packet forwarding on the LAN-side WireGuard host (eg sysctl -w net.ipv4.ip_forward=1)
  3. Set up packet masquerading (aka SNAT) on the LAN-side WireGuard host (usually done via iptables rules)

There's a complete example of this here:

https://www.procustodibus.com/blog/2020/11/wireguard-point-to-site-config/

In that example, the LAN's subnet is 192.168.200.0/24, so that's what AllowedIPs is set to in the WireGuard config of the external host (Endpoint A in the example):

AllowedIPs = 192.168.200.0/24

And in that example, packet forwarding and masquerading are accomplished by adding the following to the WireGuard config on the LAN-side WireGuard host (Host β in the example):

# IP forwarding
PreUp = sysctl -w net.ipv4.ip_forward=1
# IP masquerading
PreUp = iptables -t mangle -A PREROUTING -i wg0 -j MARK --set-mark 0x30
PreUp = iptables -t nat -A POSTROUTING ! -o wg0 -m mark --mark 0x30 -j MASQUERADE

When the WireGuard interface wg0 is up on the LAN-side WireGuard host, the external host can connect to any host on the LAN via its LAN address -- in the example, the external host (Endpoint A) can connect to a LAN host (Endpoint B) via Endpoint B's local address, 192.168.200.22.

Justin Ludwig
  • 366
  • 1
  • 4
  • 5
    Wireguard claims to be a "simple" VPN protocol/solution, yet here we are ... – adrianTNT Sep 22 '22 at 22:27
  • I think its simple for the context at this level. If you want to do more complicated things like making local networks available to the interface then you need to do a little configuration. – Nate-Wilkins Dec 21 '22 at 23:52
  • hi, i have the same question but for windows, is there anything i can do to achieve the same goal in windows? – Fadhil Ahmad Jan 20 '23 at 09:14