Enabling "Remote Access LAN" only works as expected when you are running your WireGuard server on your main router, more precisely, in the router that acts as the default gateway of the network you want to be accessible. What this option actually does is put your LAN network address in the "Allowed IPs" in the peer section of your client configuration so the client know that all your LAN addresses are accessible through the WireGuard tunnel.
In your case the packets don't have any problem to go from Wireguard Client (remote laptop) to the home laptop. The problem is in the opposite direction. When the home laptop tries to send a packet to the remote laptop, it checks if the IP address is in their same network, it isn't, and then it sends the packet to the default gateway (the main router) but this router doesn't know how to reach the wireguard network. You have to tell the main router how can reach de WireGuard network by means of adding a manual routing rule.
This kind of questions are very common in this forum. I have posted on another thread how to join two networks but your have a more appropriate title because the other ones have very specific router models in the name and people tend to overlook them.
Using an example I will tell you what you need to configure two sub-networks so you can reach any computer from any other within your network when your WireGuard server or client is not your main and only router in your LAN.
Main routers:
- You have to make your WireGuard "server" accessible from Internet
- In router 192.168.0.1 you'll have to open and redirect the WireGuard server port to the 192.168.0.254
- The main routers need to know how to reach any network not directly attached.
- You will have to add some routes manually:
- In router 192.168.0.1 you'll have to add route: 192.168.1.0/24 GW:192.168.0.254
- In router 192.168.1.1 you'll have to add route: 192.168.0.0/24 GW:192.168.1.254
Secondary Router or just a WireGuard client-server
- Connect LAN port to your main router LAN network
- Disable DHCP server, because you have a DHCP server on your main router.
- You dont't need WAN port, just LAN, so disable or disconnect any WAN, WiFi client, cellphone tethering... that acts as WAN connection and adds a default route (the goal is to remove any default gateway route).
- You will have to add a default gateway route pointing your main router:
- In router 192.168.0.254 you'll have to add route: 0.0.0.0/0 GW:192.168.0.1
- In router 192.168.1.254 you'll have to add route: 0.0.0.0/0 GW:192.168.1.1
WireGuard configuration
- Its very important to understand that what you put on "Allowed IPs" peer configuration is transformed into routing rules.
- You need to put in "Allowed IPs" not only the IP of the other endpoint but all the accessible networks through the tunnel:
- In 192.168.0.254 WireGuard "server" configuration you'll have to put in peer "Allowed IPs": 10.0.0.2/32, 192.168.1.0/24 (that's because you can reach through the tunnel to 10.0.0.2 host and full 192.168.1.0/24 network)
- In 192.168.1.254 WireGuard "client" configuration you'll have to put in peer "Allowed IPs": 10.0.0.0/24, 192.168.0.0/24 (that's because you can reach through the tunnel to all the WireGuard peers 10.0.0.0/24 and full 192.168.0.0/24 network)
- Is not the case in this example, but, if you want that a WireGuard "client" routes all traffic through the VPN tunnel, you have to put "Allowed IPs": 0.0.0.0/0 in the client peer configuration so it will be transformed into the default gateway rule for the client.
WireGuard Server 192.168.0.254 configuration example
[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = GH7HVfpCc+36LXUFkGX38Ud3rfUC3YQP+oqTSWqg2UQ=
# PublicKey = ACVoP67IWqoOyCi0F7lmWiVNbmYcVMYiBqUB8cnGhGY=
# Server = wireguard.fqdn
[Peer]
PublicKey = fMl5wKucz5asA3RGMse+9HROAhNJOtk+OHLocfwsHRc=
AllowedIPs = 10.0.0.2/32, 192.168.1.0/24
WireGuard Client 192.168.1.254 configuration example
[Interface]
Address = 10.0.0.2/24
PrivateKey = OHLUXH43WBXzNHveaamFZBOxpwSGlUfngQk5qbLi/2Y=
#PublicKey = fMl5wKucz5asA3RGMse+9HROAhNJOtk+OHLocfwsHRc=
[Peer]
PublicKey = ACVoP67IWqoOyCi0F7lmWiVNbmYcVMYiBqUB8cnGhGY=
AllowedIPs = 10.0.0.0/24, 192.168.0.0/24
Endpoint = wireguard.fqdn:51820
PersistentKeepalive = 25
More info:
In this example the two WireGuard endpoints are accessible from all the computers using their LAN IPs but not their WireGuard IPs. If you want it to be accessible through their WireGuard IPs (10.0.0.X) it would be necessary to add an additional routing rule to the two main routers: DEST: 10.0.0.0/24 GW:192.168.X.254
All the clients behind NAT, if there is no port redirection, have to use "PersistentKeepalive = 25" in order to let the UDP packets in through the NAT-firewall. When a UDP packet goes out through a firewall, the firewall keeps the port open for a few seconds waiting for a response, letting in the packets that match IP-port-source-destination of the packet that came out. Sending continuously a UDP packet to the server before the waiting expires, creates kind of a port redirect to de client.
In WireGuard, if you have more than one "client", each "client" must have a unique Private-Public Key, because WireGuard "server" identifies the "client" by the key used to encrypt the tunnel not the source IP of encrypted packets. The clients can change their public IP whenever they want and there is no interruption because WireGuard uses UDP and associates the private VPN IP (10.0.0.X) to the encryption key.
(connects to WG server and home LAN)
