Hello, sorry if this has already being solved but I really can't fix my problem.
What I want to do is the following.
I want to replace a softethervpn bridge with a local wireguard vpn. The main reason is to create a site-to-site vpn to connect 2 LAN network.
One LAN have a public ip and can be reached by opening without a problem.
The second LAN is behind a Carrier-grade NAT (isp give a private ip with dhcp and lots of user share the same public ip, can't open port and the internal private ip can't be reached from internet)
So I need the VPN to permit connection to the second LAN using the first LAN as a server. From what I read only, wireguard should permit to do this.
Ip description
LAN1: 192.168.2.1/23 public ip is reachable with DDNS
LAN2: 192.168.3.1/24
LAN1 can access device on LAN2 and LAN2 can access device on LAN1 like they were on the same bridge.
I setup the wireguard interface and LAN2 can establish a valid connection. Problem is that only the wireguard interface ip is pingable but any local ip is not.
Anyway both wireguard interface are assigned to LAN firewall zone.
The LAN1 config:
config interface 'VPN'
option proto 'wireguard'
option private_key 'MMI......'
option listen_port '51820'
list addresses '172.16.0.1'
config wireguard_VPN
option public_key 'bTc...'
option description 'Local'
option endpoint_port '51820'
option route_allowed_ips '1'
list allowed_ips '172.16.0.2/32'
list allowed_ips '192.168.3.1/24'
list allowed_ips '192.168.2.1/24'
LAN2 config:
config interface 'vpn_ta'
option proto 'wireguard'
option private_key '0CX...'
list addresses '172.16.0.2'
option listen_port '51820'
config wireguard_vpn_ta
option endpoint_host '1'?!?!?! i'm stupid'
option public_key 'HiH...'
option persistent_keepalive '25'
option endpoint_port '51820'
option description 'Taranto'
option route_allowed_ips '1'
list allowed_ips '172.16.0.1/32'
list allowed_ips '192.168.3.1/24'
list allowed_ips '192.168.2.1/24'
wg LAN1:
interface: VPN
public key: HiH....
private key: (hidden)
listening port: 51820
peer: bTc....
endpoint: [1?!?"?!"?!"?]:51820
allowed ips: 172.16.0.2/32, 192.168.3.0/24, 192.168.2.0/24
latest handshake: 59 seconds ago
transfer: 9.18 KiB received, 3.76 KiB sent
wg LAN2:
interface: vpn_ta
public key: bTc...
private key: (hidden)
listening port: 51820
peer: HiH...
endpoint: [!?"?"?"?!]:51820
allowed ips: 172.16.0.1/32, 192.168.3.0/24, 192.168.2.0/24
latest handshake: 1 minute, 22 seconds ago
transfer: 2.50 KiB received, 9.04 KiB sent
persistent keepalive: every 25 seconds