Re: WireGuard connecting hosts WAN->LAN
On Sat, Mar 14, 2020 at 16:33:44 +0100, Germano Massullo wrote: A simple question to Wireguard developers, since while asking for help in OpenWRT forum[1] I have been told that I am asking a thing that Wireguard cannot do, so I want to ask upstream if it is possible or not Scenario: A = internet (WAN) host (WireGuard IP 10.1.1.3) B = OpenWRT router (WireGuard IP 10.1.1.1) C = LAN host (WireGuard IP 10.1.1.2) I want to: 1) connect A to C passing through B. I don't want to expose C to internet at all, (so no things like port forwarding) 2) A must have C public key (and viceversa), so in case of B being compromised, the A<->C VPN will not be compromised. In a few words, I want B to just route forwards packages from A to C. This set of requirements seems odd. Do you not trust C to be able to properly ignore unwanted packets? It is possible to have C ignore layer 3 traffic (DHCP traffic is special) that is not using the tunnel. Inbound you block all traffic not destined for the tunnel's port. Outbound you block all traffic not tagged as tunnel traffic. (Wireguard provides a way to tag tunnel traffic.) The default route should be through the tunnel. Tunnel traffic should be routed through B. The configuration gets trickier if you want to send traffic to A's external address as then you have a routing dependency not based on the destination address. You can do this by having two routing tables using the tag to pick which table gets used.
Re: WireGuard connecting hosts WAN->LAN
> Scenario: > A = internet (WAN) host (WireGuard IP 10.1.1.3) > B = OpenWRT router (WireGuard IP 10.1.1.1) > C = LAN host (WireGuard IP 10.1.1.2) What you have been told is correct for the case of A connecting to C. there is no way for A to reach the Wireguard port on C without B forwarding that port. However, if you can turn it around and have C connect to A, assuming the wireguard port on A is accessible from the internet, C will be able to connect to A. Once the connection is established, traffic will flow both ways.
Re: WireGuard connecting hosts WAN->LAN
Il 14/03/20 19:16, Luis Ressel ha scritto: > On Sat, Mar 14, 2020 at 04:33:44PM +0100, Germano Massullo wrote: >> I want to: >> 1) connect A to C passing through B. I don't want to expose C to >> internet at all, (so no things like port forwarding) >> 2) A must have C public key (and viceversa), so in case of B being >> compromised, the A<->C VPN will not be compromised. > The answer you quoted is correct. If you don't wish to set up port > forwarding, and C is thus not accessible from the internet at all, A > can't establish a tunnel with it. > > You may want to consider setting up two tunnels on A: > * wg0 with B as the peer > * wg1 with C as the peer > and then route the encrypted packets of wg1 through wg0. The > disadvantage of this is that you're encrypting every packet twice, which > hurts performance and lowers the tunnel MTU. > > Cheers, > Luis Hi Luis, thank you for the explanation Have a nice day
Re: WireGuard connecting hosts WAN->LAN
On Sat, Mar 14, 2020 at 04:33:44PM +0100, Germano Massullo wrote: > I want to: > 1) connect A to C passing through B. I don't want to expose C to > internet at all, (so no things like port forwarding) > 2) A must have C public key (and viceversa), so in case of B being > compromised, the A<->C VPN will not be compromised. The answer you quoted is correct. If you don't wish to set up port forwarding, and C is thus not accessible from the internet at all, A can't establish a tunnel with it. You may want to consider setting up two tunnels on A: * wg0 with B as the peer * wg1 with C as the peer and then route the encrypted packets of wg1 through wg0. The disadvantage of this is that you're encrypting every packet twice, which hurts performance and lowers the tunnel MTU. Cheers, Luis