# Vpn architecture steering

**URL:** <https://forum.gl-inet.com/t/vpn-architecture-steering/71504>\
**Category:** VPN, DNS, Leaks\
**Created:** [September 22, 2026, 8:00pm UTC](https://forum.gl-inet.com/t/vpn-architecture-steering/71504 "2026-09-22T20:00:11Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![charles2](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/c/9dc877/32.png) [@charles2](https://forum.gl-inet.com/u/charles2)\
**Post date:** [September 24, 2026, 10:57am UTC](https://forum.gl-inet.com/t/vpn-architecture-steering/71504/4 "2026-09-24T10:57:38Z")

</div>

Hi,

Thank you for providing the detailed topology.

Based on your current setup, the Brume 2 does not appear to be strictly necessary for the initial deployment.  
Since Site 2 already has a public IPv4 address and the XVR is located behind the Site 2 Flint 2, we would suggest using the **Site 2 Flint 2 as the WireGuard Server**.

A possible topology would be:

```auto
                        Internet
                            |
             +--------------+--------------+
             | |
      Site 1 Flint 2 Roaming Users
      WireGuard Peer Individual WG Peers
             | User A / B / C...
             | |
             +--------------+--------------+
                            |
                     WireGuard Tunnels
                            |
                     Site 2 Flint 2
                     WireGuard Server
                            |
                     Firewall / ACL
                            |
                           XVR
                    HTTPS / RTSP

```

For devices at Site 1, the traffic path would be:

```auto
Site 1 LAN Device
        |
Site 1 Flint 2
        |
WireGuard Tunnel
        |
Site 2 Flint 2
        |
       XVR

```

For roaming users, they can connect directly to the Site 2 WireGuard Server instead of routing through Site 1.

```auto
Laptop / Phone
      |
Individual WG Peer
      |
Internet
      |
Site 2 Flint 2
      |
Firewall / ACL
      |
     XVR

```

The Site 1 Flint 2 can use one WireGuard profile for the site-to-site connection, while each roaming user can use a separate WireGuard profile.

 ![image](https://forum-static.gl-inet.com/original/3X/2/9/291944161e4a44491f83e6e8912eabdd4cca7670.png)

The WireGuard profile defines the VPN connection, while the firewall rules on the Site 2 Flint 2 can be used to restrict each peer to the XVR and, if required, apply different management/video access permissions.

For example, the roaming-user profiles can be limited to the XVR. If bidirectional LAN access is also required between Site 1 and Site 2, the WireGuard connection can be configured for full site-to-site LAN access.

For reference, you may also refer to the following documentation and discussions:

WireGuard Server / Remote LAN Access:

> **[WireGuard Server - GL.iNet Router Docs 4](https://docs.gl-inet.com/router/en/4/interface_guide/wireguard_server/)**
>
> Documentation for GL.iNet Router Productions

Site-to-Site WireGuard configuration:

> [@Building a Site-2-Site network manually using two GL.iNet routers(SDK 4.X)](https://forum.gl-inet.com/t/building-a-site-2-site-network-manually-using-two-gl-inet-routers-sdk-4-x/31479/9):
>
> To elaborate on the situation for three GL.inet routers Site-2-Site: wireguard server firmware \>=4.5 is required Topology： Steps： wgserver: add two profiles on admin panel of wgserver, and export conf file for wgclient’s usage. wgclient: import conf file, connect to wgserver, and turn on ”Allow Remote Access LAN” wgserver: enable ”Client to Client“ Now： PC 192.168.172.2 can access 10.0.0.3 PC 192.168.173.2 can access 10.0.0.2 wgser…

Restricting WireGuard users with firewall rules:

> [@LAN access is open via MT2500 wireguard server](https://forum.gl-inet.com/t/lan-access-is-open-via-mt2500-wireguard-server/66869/2):
>
> Hi Please try to create different WireGuard profiles, then go to LuCI - Network - Firewall - Traffic Rules and create the following rules for the WireGuard IPs that need to be isolated from the LAN: Note that you need to drag this rule above wgserver2lan. Results: isolation: allow2lan:

Hope this helps you.

---

_[View the full topic](https://forum.gl-inet.com/t/vpn-architecture-steering/71504)._