Building a Site-2-Site network manually using two GL.iNet routers(SDK 4.X)

[Cathy]

This post is to introduce the guide to config WireGuard LAN to LAN VPN (Site-2-Site) based on GL-iNet SDK 4.X fimrware.

Supported Models

Router Model	Stable	Beta
GL-MT3000 (Beryl AX)	√	-
GL-AXT1800 (Slate AX)	√	-
GL-A1300 (Slate Plus)	√	-
GL-X3000 (Spitx AX)	√	-
GL-AX1800 (Flint)	√	-
GL-MT2500 (Brume 2)	√	-
GL-AR300M (shadow)	-	√
GL-MT300N-V2 (Mango)	-	√
GL-E750 (Mudi)	-	√
GL-SFT1200 (Opal)	-	√
GL-MT1300 (Beryl)	-	√
GL-X750 (Spitz)	-	√
GL-XE300 (Puli)	-	√
GL-X300B (Collie)	-	√
GL-B1300 (Convexa-B)	-	√
GL-AR750S (Slate)	-	√
GL-S1300 (Convexa-S)	-	√

Network Topology

1. Login the web interface of AX1800, go to VPN > WireGuard Server and click on the Generate Configuration button. Then Click on the Start button to enable the WireGuard Server.
   

   
   
   
   

2. Go to Profiles and add a New User.
   

   

3. Click the Share icon to review and download the configuration file.
   

   

[Interface]
Address = 10.0.0.2/24

PrivateKey = 6CNNJMq8pFCq4uG15+woPhP+fReD4EQWse86hqSbf1A=
DNS = 64.6.64.6
MTU = 1420

[Peer]
AllowedIPs = 0.0.0.0/0,::/0
Endpoint = 42.200.xxx.xxx:51820
PersistentKeepalive = 25
PublicKey = DzlU6qbaKJqpbpP2GS5cUOFWiVmPS68wBHISi0UDzQ4=

Note: make sure the Endpoint is the same as the WAN IP address of this router, if not, you shall config port forward for this IP address. Here in this example, the WAN IP address of this router is 192.168.89.173, I can just use this IP address instead since the client and server are in the same internal subnet.

4. Go to VPN > VPN Dashboard, click the Setting icon and enable the Allow Remote Access LAN option.
   

   
   
   
   

5. Login the web interface of AXT1800, go to NETWORK > LAN and change the Router IP Address to 192.168.100.1
   

   

6. Go to VPN > WireGuard Client and add new group and drag the downloaded config file to the box. Then click on Apply when it shows “Upload successful”.
   

   

7. Go to VPN > VPN Dashboard, select the proxy mode to Auto Detect, and click on the Setting icon to enable Allow Remote Access LAN. Then enable the WireGuard client.
   

   
   
   
   
   
   Note: here the Client Virtual IP(IPv4) 10.0.0.2 is for route rule setting on the VPN server router.

8. Login the web interface of AX1800, go to VPN > VPN Dashboard and click the Routing icon to add a route rule.
   

   

9. The target address shall be set as the subnet of the VPN client router. Here it is 192.168.100.0/24 in this example. And the gateway is the client router virtual IP 10.0.0.2 in the previous step. After that, back to VPN Dashboard and restart the WireGuard server, to take the route rule into effect.
   

   

10. The two subnets can access each other.

[bring.fringe18]

Can you post a list at the top of this HOW-TO of what devices use SDK 4.x?

[yuxin.zou]

It is here.Includes those released and those being adapted.

Overview - GL.iNet Router Docs 4

[ChrisP]

I’m using a similar approach with GL firmware 3.x, just by setting the WG server on one end, generating a config file that I use to set another GL.iNET router as the WG client, it has worked great. Some minor issues like when the client loses power it doesn’t always connect back, but overall it’s a great way to expand the LAN across the pond.

[elorimer]

Awesome, very clear and to the point.

Is it clear that this is split-tunnelling on both sides? That is, each subnet goes to other addresses outside of the tunnel?

And/or, perhaps add how to have all the client internet traffic route through the tunnel?

[bring.fringe18]

Yeah, you bring up some interesting questions. As this is ultimately all WG based would GL GUI’s VPN Policies be honored in such a set?up

[mkdr]

I have followed this guide but it doesnt work to reach 192.168.100.1 from clients which connect to the wireguard server. is there anything else to add to the routing to make it work?

I have successfully linked left (192.168.100.1) and right (192.168.8.1) routers through this howto. But when I connect from the phone (bottom) device to right wireguard server. I cant reach the left router (192.168.100.1)

I can access 192.168.100.1 from the 192.168.8.0 LAN, but I cant access 192.168.100.1 from the wireguard client through my phone.

For the phone I have added another Wireguard client config (10.0.0.3). the link between the routers use 10.0.0.2

[hansome]

Upgrade firmware to 4.5 for 192.168.8.1, and turn on client to client option.
FYI How to join wireguard mesh and access peer's subnets? - #2 by hansome

[hansome]

To elaborate on the situation for three GL.inet routers Site-2-Site:
wireguard server firmware >=4.5 is required

Topology：

Steps：

1. wgserver: add two profiles on admin panel of wgserver, and export conf file for wgclient’s usage.

2. wgclient: import conf file, connect to wgserver, and turn on ”Allow Remote Access LAN”
   

   

3. wgserver: enable ”Client to Client“

Now：

PC 192.168.172.2 can access 10.0.0.3

PC 192.168.173.2 can access 10.0.0.2

4. wgserver: add custom routes
   
   

Now：

PC 192.168.172.2 and 192.168.172.3 can communicate, ie, site-to-site network is done.

Add more wgclient to join more sites, just as 10.0.0.2 and 10.0.0.3.

[alexb]

Hi experts,

If the WireGuard client side is a GL-iNet router (e.g. GL-X3000), but the server side is not (e.g. TP-Link), are any extra steps required to make this work for full site-to-site connectivity? I have successfully established the WireGuard connection (green dot on client side), but cannot ping/reach network hosts behind the client router from the server side. I have chosen the GL-X3000 router to be a WireGuard client instead of server, because it is behind CG-NAT, and setting it up as a server would require use of the AstroRelay service which makes the implementation more complicated.

Do we need to create any static routes on the WireGuard client side also? The example above only shows a static route created on the Server side. If required, can this be done via the web GUI interface, or do we need to SSH into the router or use LuCI.?

Thanks,
Alex

[bring.fringe18]

The premise for S2S is the same. The question in your case is how to configure the routing to match on your TP Link’s WG Server.

@alexb

Do we need to create any static routes on the WireGuard client side also?

Routes? No, but don’t forget to check the AllowedIPs in all the confs.

[alexb]

AllowedIP is set as 0.0.0.0/0