News for hackers. Stuff that matters.

A comment on NetMaker: Connect Everything with a WireGuard VPN.

Re:NetMaker: Connect Everything with a WireGuard VPN by joeframbach on Wednesday August 16, 2023 @01:41AM (#37143256)
A pain point I still haven't resolved with WG is this. From my phone, I want to access my homelab through the WG server at home, but everything else through an external WG VPN somewhere else. My homelab ip range is 10.10.0.0/24 or whatever, but the external VPN is some other range. Wireguard doesn't seem to like this. The alternative is to route my phone to home for 100% of traffic, and my home router would egress through the external VPN. But I don't want my home network to be the bottleneck, I don't exactly have the best Internet service at home. From a cursory search through NetMaker docs, I didn't see anything that explicitly shows how to configure vpns, or, I don't know what to call it, bridging multiple wireguard networks.
[ Parent | on HN ]
Re:NetMaker: Connect Everything with a WireGuard VPN by winecamera on Wednesday August 16, 2023 @01:55AM (#37143331)
Assuming your Wireguard server at home is running Linux, you can achieve this by adding a second routing table and adding routing policies.
[ Parent | on HN ]
Re:NetMaker: Connect Everything with a WireGuard VPN by _rs on Wednesday August 16, 2023 @02:15AM (#37143431)
Is it not possible to configure this on the phone itself?
[ Parent | on HN ]
Re:NetMaker: Connect Everything with a WireGuard VPN by WirelessGigabit on Wednesday August 16, 2023 @01:14PM (#37150227)
No as on most phones you cannot set up static routes.
[ Parent | on HN ]
Re:NetMaker: Connect Everything with a WireGuard VPN by rudasn on Wednesday August 16, 2023 @02:33AM (#37143513)
What's your setup right now?

A single wg interface/config on your phone, with two peers, one for home wg and one for remote vpn, with AllowedIPs on the home peer as 10.10.0.0/24 and AllowedIPs on the remote vpn peer as 0.0.0.0/24?

Have you tried excluding the cidr of your home wg from the AllowedIPs of the remote vpn? Like not having 0.0.0.0/24, but one or more entries that end up excluding local cidrs.

[ Parent | on HN ]
Re:NetMaker: Connect Everything with a WireGuard VPN by joeframbach on Wednesday August 16, 2023 @09:28AM (#37146744)
The external VPN provider dictates what my interface's IP range is. I generated a new WG config using the UI, and it comes with interface IP 10.66.123.123/32. If I want my home ip to be 10.10.0.2/32, then I'll have to set it as 10.0.0.0/8, and the VPN provider didn't seem to agree with that.

I have two wg interfaces and I manually switch between them.

[ Parent | on HN ]
Re:NetMaker: Connect Everything with a WireGuard VPN by zeroflow on Wednesday August 16, 2023 @02:45AM (#37143576)
You should be able to have two peers. The only thing I see is, that you may need to explicitly define the routing.

The first peer is easy, with allowed IPs of 10.10.0.0/8. The 2nd peer will need more configs, as it should route everything else.

See this answer for an example where all ranges that are not RFC1918 are listed: https://serverfault.com/a/304791 I expect, that you need to enter those ranges as AllowedIPs for the peer that should route to the public internet.

[ Parent | on HN ]
Re:NetMaker: Connect Everything with a WireGuard VPN by winecamera on Wednesday August 16, 2023 @03:09AM (#37143718)
There's this handy website that calculates the allowed CIDRs with exclusions https://www.procustodibus.com/blog/2021/03/wireguard-allowed...
[ Parent | on HN ]
Re:NetMaker: Connect Everything with a WireGuard VPN by cpach on Wednesday August 16, 2023 @03:54AM (#37143992)
Semi-related: I really like the typeface/layout on that site!
[ Parent | on HN ]
Re:NetMaker: Connect Everything with a WireGuard VPN by Modified3019 on Wednesday August 16, 2023 @04:45AM (#37144354)
Yeah same. I'm new to trying to find fonts, but it looks like it's "Forum" font family for the header and "Proza Libre" for the body

https://fonts.google.com/specimen/Forum

https://fonts.google.com/specimen/Proza+Libre

[ Parent | on HN ]
Re:NetMaker: Connect Everything with a WireGuard VPN by erinnh on Wednesday August 16, 2023 @04:23AM (#37144180)
Why not have a standing WG connection between your home and external WG server and connect only to the external server?

You then route your home traffic through the home wg connection and all other traffic will exit the external server directly.

[ Parent | on HN ]
Re:NetMaker: Connect Everything with a WireGuard VPN by afeiszli on Wednesday August 16, 2023 @09:58AM (#37147106)
Netmaker may help with this. You configure an "Egress Gateway" to 0.0.0.0/0 as your internet VPN, inside of a Netmaker network of 10.10.0.0/24. We do our routing rules differently and it is meant to be compatible. However, I'm a bit surprised you have this issue with regular WireGuard, as it tends to be quite stable for this sort of setup in my experience.
[ Parent | on HN ]