How to access specific IPs via WireGuard peer?

Installing and Using OpenWrt Network and Wireless Configuration
1

For ease of understanding, I am listing out my devices and IPs:

  • Home Router LAN:192.168.50.1 WG:10.0.0.1
  • Home Computer LAN:192.168.50.10
  • Office Computer WG:10.0.0.4
  • Remote Server 47.x.x.x

I am at home and want to access the remote server via the office computer (via company network).

/etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth2'
	list ports 'eth3'
	list ports 'eth4'
	list ports 'eth5'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option ipaddr '192.168.50.1'
	option ip6assign '64'

config interface 'HKT4'
	option proto 'dhcp'
	option device 'eth0'

config interface 'HKT6'
	option proto 'dhcpv6'
	option reqaddress 'try'
	option reqprefix 'auto'
	option device 'eth0'

config interface 'WireGuard'
	option proto 'wireguard'
	option private_key ''
	option listen_port '51820'
	list addresses '10.0.0.1/24'

config wireguard_WireGuard
	option description 'Xperia1III'
	option public_key ''
	option private_key ''
	list allowed_ips '10.0.0.2/32'

config wireguard_WireGuard
	option description 'deskmini@office'
	option public_key ''
	option private_key ''
	list allowed_ips '10.0.0.3/32'

config interface 'HGC4'
	option proto 'dhcp'
	option device 'eth1'
	option metric '10'

config wireguard_WireGuard
	option description 'odyssey@office'
	option public_key ''
	option private_key '
	list allowed_ips '10.0.0.4/32'

/etc/config/firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'HKT4'
	list network 'HKT6'
	list network 'HGC4'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config rule
	option name 'WireGuard'
	list proto 'udp'
	option src 'wan'
	option dest_port '51820'
	option target 'ACCEPT'

config include 'pbr'
	option fw4_compatible '1'
	option type 'script'
	option path '/usr/share/pbr/pbr.firewall.include'

config forwarding
	option src 'lan'
	option dest 'wan'

config zone
	option name 'WG'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'WireGuard'

config forwarding
	option src 'lan'
	option dest 'WG'

config forwarding
	option src 'WG'
	option dest 'lan'

config forwarding
	option src 'WG'
	option dest 'wan'

I have ran this line on the router (192.168.50.1):
ip route add 47.x.x.x/32 via 10.0.0.4 dev WireGuard

However, connecting 47.x.x.x on my home computer failed.

Running on router:

traceroute 47.x.x.x
traceroute to 47.x.x.x (47.x.x.x), 30 hops max, 46 byte packets
 1traceroute: sendto: Required key not available

How should I fix the configurations?

Thanks.

2

The server will need a route back to your WG address on your work computer. Or, you can see if you can setup masquerading of the lan address on your work computer such that your the IP address that the server sees is actually the work computer's lan IP.

That said, do you have specific permissions to do this? I ask because:

  1. If you do, your IT admin can help configure the server appropriately and/or help you configure your work computer such that it masquerades the wg interface.
  2. If you don't, you should understand that this type of configuration opens a really serious security threat to the company data, and you probably should be requesting an IT approved solution for remote access to the server. If you don't, and you're not specifically authorized to do what you're doing now, you could face serious consequences (depending on your company's policies, of course). [not here to lecture, but I do want you to be aware of the potential risks here]
3

May I know how to setup masquerading on the office computer? It is running Ubuntu 22.04. Thanks.

4

I don't actually know... never done it. But I suspect that you can find information on Ubuntu support channels (i.e. documentation, user groups, etc.).

1 Like
5

thank you very much.