IP cameras on other subnet in Wireguard site-to-site config

[GasGas277]

Quick explanation that may be helpful for others:
Two OpenWrt devices is connected through a Wireguard site-to-site configuration.
The remote router has a second interface+firewall zone for IP cameras as stated in a previous thread.

Firewall traffic rules override zone settings?

I configured a separate network with a separate interface on a different subnet than the LAN network that I only use for IP cameras. I do not want to give the cameras network access to the internet or to the LAN devices to avoid the cameras to access internet through WAN interface (phoning home). It can be done by just creating a firewall rule that reject forward traffic to WAN interface from the specific camera IP addresses (if on LAN network). But since I also do not want the cameras to be a…

The main router is 192.168.1.1 and the remote router is 192.168.3.1. The camera interface on the remote router has IP address 192.168.5.1.

Both routers can reach each other and all devices on both networks can reach each other successfully.

To be able to reach the devices on the 192.168.5.0 network from the devices on the 192.168.1.0 network I had to set in the wireguard peer config of the main 192.168.1.1 router AllowedIPs to "192.168.5.0/24" where /24 means all 254 usable IP adresses in the last digit of the 192.168.5.x subnet, and /24 is corresponding to netmask 255.255.255.0. Just as the site-to-site configuration where I initially had to add "192.168.3.0/24" to AllowedIPs.

After that go to the the shell console of the 192.168.1.1 router:

uci commit network
service network restart

Or reboot.