Site to site using Wireguard and the remote SFT-1200 WAN port (not LAN port)

Router
1

I am trying to connect my local network to a remote site. Locally I have an ASUS XT8 router that has a Wireguard server included. At the remote site there is a very basic EE router providing internet access for the users, no question of it supporting a VPN or any other tools.

What I want to be able to do is access the remote network from my local one. To do this I intend to put an Opal (GL-SFT1200)

at the remote site and use the Wireguard client to connect automatically to the Wireguard server in my XT8 router.

The catch is I cannot move the devices on the remote network, they need to stay “as is” and cannot be moved to the SFT-1200 LAN.

So .. my plan is to attach the SFT-1200 WAN port to the remote network and have it obtain an IP address from the existing DHCP server. It then has internet access and can establish a Wireguard connection to the XP8 on my local network.

That all works fine. What I now need to do is route the Wireguard traffic on the remote network to which the SFT-1200 WAN interface is connected.

I have set up a forwarding rule to forward received Wireguard traffic to the WAN port and onto the remote network. This also works and I can ping attached devices EXCEPT I don’t get a reply (I have monitored the traffic).

What do I need to do to get the Wireguard traffic flowing in both directions on the remote network through the SFT-1200 WAN port? Is it even possible?

I’m competent at using SSH. I will try and sketch the topology and post later.

3

Hi,

Thanks for the detailed explanation.

There are two possible approaches you can consider:

  1. Add a static route on the EE router.

If the EE router supports static routes, you can add a route for your local-site subnet and use the SFT1200 WAN IP as the gateway. This keeps the traffic fully routed without NAT.

  1. Use SNAT/Masquerade on the SFT1200.
    If the EE router does not support static routes, the SFT1200 can masquerade traffic forwarded from WireGuard to its WAN-side network.
    The remote devices will then see the connection as coming from the SFT1200 WAN IP, so their replies will naturally return to the SFT1200.

Hope this gives you a useful direction to proceed.

4

Hi. Charles,

Thank you for the guidance, I’ll certainly take a look at the EE router and see whether it supports static routes.

Regarding solution 2 does that mean all of the remote traffic is then routed through to my local network?

thanks again for your interest.

Kind regards,

David

6

Hi,

No. In this case, the SNAT/Masquerade rule would only apply to traffic coming from the WireGuard tunnel and being forwarded to the remote WAN-side subnet.

Existing remote devices will continue using the EE router as their default gateway, so their normal internet traffic will not pass through the tunnel.

The masquerade only affects connections initiated from the LAN behind your ASUS XT8 (the WireGuard Server side), so that the replies from the remote network can return correctly through the SFT1200 and the WireGuard tunnel.

7

I had a look at the RE router on site and it has the most basic capabilities imaginable. So, it’s the second suggestion for which many thanks. I’ll let you know how it goes!