Client Virtual IP (IPv4) 10.0.0.2/24
IP 35.129.37.191
I can log into the client router from the server side so its connected and working
I do NOT have IP Masquerading on on either side only Remote Access LAN
I have rule route on server set to Target address 10.0.0.2/24 no gateway no metric no mtu scope=link
under Firewall "open ports on router" on BOTH I have Port 1018 TCP/UDP enabled
So the Internet side is working but still no local area network or network resources working....
OK, over the Holiday weekend I reset both routers to factory. I set the following
GL-MT6000 Flint 2 (Only Router on Lan)
Set Timezone
Set Lan to 10.22.10.22
Check IP to ISP 174.85.9.222
Set winguard Server to IPv4 10.0.0.1/24 port 1018
Not sure what to set route rule at?
Set Wireguard Server Options – Remote Access Lan ON, MTU 1420
Note: IP Masquerading OFF Client to Client OFF
Set router Firewall Open Ports on Router TCP/UDP port 1018
Set Dynamic DNS to Enabled
Created host profile for client with DDNS on
GL-AX1800 Flint (Only Router on Lan)
Set Timezone
Set Lan to 10.22.20.22
Check IP to ISP 35.129.37.191
Set router Firewall Open Ports on Router TCP/UDP port 1018
Set New Provider in Wireguard Client
Added Client profile from step 9 above
Set Winguard Client Options to Remote Access Lan ON
Set Winguard Client Options to IP Masquerading ON
Set Winguard Client Options to MTU 1450
Set Winguard Client ip to 10.0.0.2/24 port 1018
Started Flint 2 VPN Server = green light
Started Flint VPN Client = green light
Client reports Virtual IP (IPv4) = 10.0.0.2/24
FROM SERVER PC I can access the Client router setting if I put 10.0.0.2 in a browser window.
The VPN part is done and working for internet traffic!
Now for the VLAN - What changes are needed to allow this to access local network resources?
I have windows 10 on all computers, the server has about 4 Drives and a NAS with 2 drives and we have printers on both server and client that need shared – none can be seen yet
To share we use namespaces like [\server1\cdrive](file://server1/cdrive) [\workstation\checkprinter](file://workstation/checkprinter) stuff like that... But that should not matter either the local network is accessable or it is not. Currently it is not. Other than REMOTE ACCESS LAN what other settings are required to finish this?
I assume the last step is the ROUTING tables? but I did not see anything on how to edit those? I would think selecting REMOTE ACCESS LAN on each side did that step for me?
This could be due two things see @admon reaction, but also it can be dhcps rebind protection.
Does pinging to the wireguard virtual ip work?
edit:
I also notice this:
10.0.0.5/24 usually this is not recommended for a site to site vpn, you essentially want:
the server needs:
10.0.0.1/24 <- many people including myself make the mistake in turning this into a host bit, if it looks like that ending with 0/24 that is wrong this can also be a cause it is not working.
For the peers its better to use more abstract approach:
You use 10.0.0.5/32 and for allowed ip: 0.0.0.0/0 on the client.
Can you explain this a little better? The system sets up the vpn at the .2/24 if I change that to .2/32 then nothing works
For the peer having 10.0.0.5/32 means that your client config explicity needs 10.0.0.5, if you replace that with /24 the client peer can be more ip.
Technically if you plan for multiple site to site connections you want a more strict/static approach then 10.0.0.5/32 is more feasible.
If you want peer to peer communication, this will be handled by the wireguard server and from there the firewall rules, so /24 is not needed for this only if you want to talk to the peers directly.
So both peer config can be valid, but /24 makes a peer able to talk directly to other peers.
Once the 'Allow Remote Access LAN' enabled in the router which as the VPN server, the PC in the router which as the VPN Client is able to access the SERVER router. Can try to ping the Server LAN IP 10.22.10.22 or those LAN devices.
Please shows the return of the 'ip route' in SSH in the Client router.
UPDATE - the network is working on the CLIENT as in I can access SERVER resources via their IP address. instead of their namespace 10.22.10.172 gets me to my workstation instead of "\ \ patrick" so namespaces dont work but IPs do. But the server still does not have access to the clients devices when I try to reach 10.22.20.245 (the client side PC) it cant ping or connect. AND how will this work with printers that are SHARED from windows conputers, they technically dont have an IP address
From the server I can ping 10.0.0.2 but nothing else
tSERVER raceroute to 10.0.0.2 (10.0.0.2), 30 hops max, 46 byte packets
1 10.0.0.2 24.927 ms
From the client I can ping 10.22.10.any ip on server and it works.
CLIENT traceroute to 10.22.10.222 (10.22.10.222), 30 hops max, 38 byte packets
1 10.0.0.1 64.458 ms
2 10.22.10.222 64.303 ms
My gut says this is a router table issue on server at this point?
I applied the route from there with my numbers and BAM! Working as intended! The namespaces dont work but I will just assign IPs to each device and re-map all shared printers from the PCs IP.
Razkle
