Configure Routing for wireguard and windows remote

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello,

i would like to connect to a local pc from a remote pc. I have set up wireguard in the 10.0.1.0/24 subnet and my local lan is set to 10.0.0.0/24 sub net. The remote client is configured using:

[Interface]
PrivateKey = *
Address = 10.0.1.1/32
DNS = 10.0.0.1

[Peer]
PublicKey = *
AllowedIPs = 10.0.0.2/32
Endpoint = *.duckdns.org:51820
PersistentKeepAlive = 25

I have added the 10.0.0.2 (local client I want to connect to via windows remote) to the hosts file of the remote client.
Unfortunately I can not establish a connection to the local pc. When i have the remote pc connected inside the local lan connecting to the remote pc via windows remote works.

Do I need to allow traffic between local lan and wireguard interface?

I did follow this guide to set up the wireguard server.

2

Should be 10.0.0.0/24 and 10.0.1.0/24

3

Unfortunately that does not work.

4

What is the remote subnet?
It should be different from local and WG subnet.

Furthermore please connect to your OpenWRT device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact keys, passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/firewall
ip route show
ip rule show
wg show
5

Thanks for getting back to me. I was able to solve the problem. For some reason I had not enabled the port forward. Thus I was able to use the wg tunnel inside my network but not outside.

To clarify. When there is need to use a wireguard tunnel to use a safe connection for windows remote. This tutorial works fine.

wireguard subnet 10.0.1.1/24 (server adress) needs to be different to your local lan subnet 10.0.0.1 (router adress) and your remote lan subnet.

for the remote windows client pc you need to add a entry to your hosts file for the local PC you would like to connect to. Which should also habe a static lease for local lan address.

That sould be sufficient.

1 Like