Sat Jul 29, 2023 9:21 pm
Well think of the logic,
You are conducting peer to peer connections.
That means your mobile user are dumped onto the main router A.
To reach the other routers for the purpose of being able to configure them two things need to happen,
The Router A has to know how to route to routers B,C,D, this is accomplished quite easily if all are on the same wireguard subnet.
To reach the other routers to reach their Lan, two things have to happen,
The router A has to know how to route to the LANS of B,C,D and thus we have routes for routers B,C,D Lans on Router A.
(The converse is true, each router B, C, D, to read Router A lans must have a route for the LANS.
What should be clear is that if a Subnet or IP address you need to reach is not LOCAL to the current router one has to make a router telling the router where to send the traffic.
What may not be clear but is also true, ALLOWED IPs have to include the subnets you wish to reach at the other END.
HENCE ROUTES and ALLOWED IPs for those non-local subnets have to be added to the config.
Now for the second part of each.................... We have to ensure firewall rules allow the remote users who have just landed at Router A, to basicaly RENTER the tunnel towards Routers B, C, D.
I call this one the RELAY RULE.
add action=accept chain=forward in-interface=wireguard1 out-interface=wireguard1 name
The above rule applies specifically for the case where all are on the same wireguard subnet. In your case you have a different subnet and thus the rule would look a bit different:
add action=accept chain=forward in-interface=wireguardMobileMobile out-interface=wireguard1
In this regard the router would receive a query from the mobile user for a subnet on router D. The router would check if dst address exists on the wireguard allowed IPs. It would find a match for Router D, and know which specific peer to send the traffic down, then using the IP routes, know where to send that information. The relay firewall rule allows the traffic to come in on the mobile wg interface and then go out the main wireguard interface.
By the way you have three options.
a. Put all on same wireguard interface subnet
b. Have two different wireguard interfaces as you have done.
c. Have two separate IP addresses/subnets attached to the same wireguard interface
Example c.
Router A
- address=10.10.10.1/24 interface-wireguard1 network=10.10.10.0
-address=10.20.20.1/24 interface=wireguard1 network=10.20.20.0
In this case the first wireguard rule above covers this, since both are associated with wireguard1.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Now at Routers B, C, D, since you have a different wireguard interface and different subnet for mobile users, they would need to have the mobile users on their allowed IPs and you guessed it.....
an IP router for those mobile users.
The same holds true for the different wireguard address but same wireguard interface as the routers B, C, D do not know it exists, so allowed IPs and IP routes.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
In conclusion all on the same subnet is probably the most efficient and less prone to error.
I understand your concern about controlling who goes where.
This is best accomplished IMHO at the receiving router by use of the firewall rules lets say at routers B,C,D.
Here limit where the users from ROUTER A and mobile can access
The same concept at Router A, on the firewall rules limit the access of mobile users and remote lan traffic from B,C,D on the local Router A as you see fit.
