Hello. I would appreciate any assistance in setting up a WireGuard VPN network.
I have installed two GL.iNet MT2500 routers and one TPLink MESH Router.
Router 1 (GL.iNet MT2500) is the gateway for my company network. The IP address is 192.168.3.1 and the address range is 192.168.3.0/24.
Router 2 (TPLink) is a gateway router connected to the LAN side of Router 1. The WAN IP Address is 192.168.3.100. The LAN IP address is 192.168.30.1 and the address range is 192.168.30.0/24.
Router 3 (GL.iNet MT2500) is installed on the LAN side of a customer's network using the WAN port of Router 3. The customer network is 10.14.24.0/20. The WAN IP address of the router is 10.14.24.100. The LAN IP address of the router is 192.168.8.1. The address range is 192.168.8.0/24. Nothing is connected to the LAN side of Router 3.
I am running a WireGuard VPN server on Router 1. The WireGuard network is 10.0.0.0/24
I am running a WireGuard Client on Router 3. The IP address of the WireGuard client is 10.0.0.4
I am trying to configure the WireGuard Server on Router 1 and the WireGuard client on Router 3 such that I can access the customer network on Router 3 (10.14.24.0/20) from my network on Router 2 (192.168.30.0/24).
So far, the traffic from my PC (192.168.30.50) from the LAN side of Router 2 does not route through the VPN server on Router 1 to the customer network on Router 3. A tracert shows the traffic attempting to go out the WAN port on Router 1 instead of the Wireguard VPN server.
Can someone help me with the configuration? I have tried various route and firewall settings. I can't seem to get it to work. AI has me going in circles. The Firmware on the GL.Inet routers is 4.7.13 release 2.
A clearly stated question. The tricky part is that Router 3 will ordinarily block traffic from the tunnel to its WAN interface.
Your PC on Router 2 wants to go to a a 10.14.24.0/20 address. That isn't local to Router 2, so it passes it on to its default gateway of 192.168.3.1 (Router 1). So far so good.
Router 1 needs to know to send traffic for 10.14.24.0/20 down the wireguard tunnel to Router 3. So the allowed IPs for Router 1 need to be 10.14.24.0/24 and 10.0.0.4/32.
The customer's router needs to forward the wireguard port to Router 1. With a /20 network I assume the customer has some IT folks to help you do that.
Router 3 needs to know to send return traffic down the tunnel, so it should have in its AllowedIPs 192.168.3.0/24, 10.14.24.0/20 and the Wireguard server's wireguard IP (10.0.0.1/32?). Or, 0.0.0.0/0.
At that point the tunnel should form. Does it?
The problem now is that the firewall on Router 3 will pass the tunnel traffic to 192.168.8.0/24, but not to the WAN addresses. So you need to insert a firewall rule in Router 3 to accept/allow traffic from the wgclient zone to the wan zone. For that you need to go into LuCI and configure the wireguard zone to accept input, accept output, accept forward, masquerade checked and forward to destination zone WAN.
I think that should work. If I were the IT person for your customer I'd have the willies because my network is now wide open to Router 1, and a supplier's access to my network is a known threat vector.
I agree with your logic. Based on the tracert, when I try to ping from my computer on 192.168.30.50 to a device on the customer LAN (10.14.24.100), the traffic always goes out Router 2 WAN instead of the Wireguard Server on Router 2.
I think the hang up is I'm missing a setting or Route on Router 2 that will force all traffic to 10.14.24.0/20 to the WireGuard Server. The traffic goes out the WAN interface instead. I have set a Global Route on the WireGuard VPN server on Router 2 to route the traffic to my WireGuard client IP (10.0.0.4) and I have set the Firewall on Router 2 to accept all forwarded traffic from the LAN interface and the WGSERVER interface. I just can't seem to set the correct switch to get the traffic to route out of Router 2.
Now I'm confused. In the original post you said the wireguard server was on Router 1. I saw it as:
PC (192.168.30.50)
|
Router 2 (LAN subnet 192.168.30.0/24, LAN IP 192.168.30.1/ WAN IP 192.168.3.100) (TPLink)
|
Router 1 (LAN subnet 192.168.3.0/24, LAN 192.168.3.1 / WAN unknown) (MT2500) (Wireguard server 10.0.0.1)
|
Interwebs
|
Client Router (LAN subnet 10.14.24.0/20, LAN 10.14.24.1 / WAN unknown) (Model unknown) (weird subnet, should be 10.14.16.0./20)
|
Router 3 (LAN 192.168.8.1 / WAN 10.14.24.100) (Wireguard client 10.0.0.4)
And I thought you wanted traffic from the PC to over the tunnel to router 3 and then back up to a device on the client router's subnet of 10.14.16.xx. Regardless, it could be wireguard is rejecting 10.14.24.0/20 and you should try 10.14.24.0/24.
In other words, you want to access devices on Router 3’s WAN-side network from the PC connected to the TP-Link.
Could you confirm whether this is correct, and whether “Router 2” in your follow-up refers to the company MT2500 running the WireGuard server?
If so, could you please share remote access to both MT2500 routers with our support team through GoodCloud, following our remote support guide?
After sharing both MT2500 routers, please enable Remote Web Access and Remote SSH on each device, then send us their MAC addresses and temporary admin passwords via private message.
Once we receive the device-sharing details, we can help you remotely check and adjust the settings through GoodCloud. Thank you for your support and understanding.