Wireguard server - access peer's subnet

Installing and Using OpenWrt Network and Wireless Configuration
1

I use OpenVPN on a GL-inet (with their UI re-skin)

I want to have a manual WG mesh that connects two remote sites, both running an OpenWRT glinet router, a cloud VPS running ubuntu, and a roaming device, running android.

The android and ubuntu devices support mesh configs well, allowed Ips can be specified etc.

OpenWRT only supports 1 peer in client mode - so that doesn't work
OpenWRT's server mode supports multiple peers so I can configure that and then edit /etc/config/wireguard_server as such

config servers 'main_server'
        option address_v6 'fd00:db8:0:abc::1/64'
        option port '51820'
        option fwmark '0x80000'
        option ipv6_enable '0'
        option address_v4 '10.10.0.14/24'
        option private_key ''
        option public_key 'kPrL4QLTyBDV1VQNmA='
        option access 'ACCEPT'
        option masq '0'

config peers 'peer_5223'
        option name 'The VPS'
        option peer_id '5223'
        option end_point 'vpn.mydomain.com:51820'
        option presharedkey_enable '1'
        option presharedkey '5O6hCb'
        option dns '10.10.0.1'
        option mtu '1420'
        option persistent_keepalive '25'
        option public_key 'wxIUgC7='
        option private_key 'l'
        option client_ip '10.10.0.1/24'
        option deprecated '0'
        option allowed_ips '10.10.0.14/32, 192.168.0.1/24'

config peers 'peer_4767'
        option name 'phone'
        option peer_id '4767'
        option presharedkey_enable '0'
        option mtu '1420'
        option persistent_keepalive '25'
        option public_key ''
        option private_key ''
        option client_ip '10.10.0.2/24'
        option deprecated '0'
        option dns '10.10.0.1'
        option allowed_ips '10.10.0.14/32, 192.168.0.1/24'

config peers 'peer_8370'
        option name 'The other router'
        option peer_id '8370'
        option presharedkey_enable '0'
        option mtu '1420'
        option persistent_keepalive '25'
        option public_key ''
        option private_key ''
        option client_ip '10.10.0.6/24'
        option deprecated '0'
        option dns '10.10.0.1'
        option allowed_ips '10.10.0.14/32, 192.168.0.1/24'

When I run the server, devices happily connect and can access my subnet. However, I have two issues that are revealed by the /tmp/wireguard/wgserver config.

[Interface]
PrivateKey= redacted
ListenPort=51820
FwMark=0x80000
[Peer]
PublicKey=wxIUgC71xOEu4bdYKF/e+Yrn8vgnrKG2BCGE=
PresharedKey= redacted
AllowedIPs=10.10.0.1
PersistentKeepalive=25
[Peer]
PublicKey=38dHkA0/mkT8HJwjvmY5w7K1BG4FaCxU=
AllowedIPs=10.10.0.2
PersistentKeepalive=25
[Peer]
PublicKey=4fVyKr2P91QHUeXpsaE/VsVYe4KdNbq0/Xw=
AllowedIPs=10.10.0.6
PersistentKeepalive=25
  1. The endpoint for the peer is not specified, so the server waits for the peer to start the connection, all fine for ubuntu and android, but the two OpenWRTs will wait for the other to start the connection and thus never connect. (I cant find a documented option endpoint 'somedomain.com' for peers
  2. There is no way to specify allowedips for the server, so the server can have no access to the peer's subnets.

Does anyone have any ideas?
I tried specifying static routes in luci eg. 192.168.99.0/24 via 10.10.0.6 but pings returned a required key not available error or similar.

3

Official OpenWrt has the same Wireguard as any other Linux. Wireguard is a peer-to-peer paradigm-- any peer can be one to one or one to many.

The configuration you've posted is a GL specific extension, you need to ask in their forum. Concepts of "servers" and "clients" are not in official OpenWrt, it has interfaces of protocol wireguard and attached peers.

4

Ok I've asked in their forum

However OpenWRT seems to use similar terminology and UCI configs, thus I assumed (am I wrong?) that the Gl-inet service is just a UI overlay of the OpenWRT implementation

5

We wouldn't know about GL.iNet.

6

How would you do it on native WRT? I can't find any good tutorials for mesh configuration on open WRT

7

Can you show a diagram or picture of what you're referring to?