WireGuard site-to-site between two routers, one of which behind CG-Nat?

Installing and Using OpenWrt
1

HOME A (Public WAN IP)
Linksys WRT32X on OpenWrt 23.05.2
LAN IP range: 192.168.13.1/24
WireGuard server running on port 51820 forwarded
WG IP range: 192.168.9.1/24

HOME B (4G/LTE CG-Nat)
Linksys WRT1900ACS on OpenWrt 23.05.2 behind 4G/LTE router on bridge mode
LAN IP range: 192.168.5.1/24

I want to create a WireGuard site-to-site connection between HOME B and A, so I could access the LAN of HOME B network when connected via WireGuard to HOME A router. But I want each network to access internet through their WAN interface (not to route all traffic through the WireGuard interface).

Do I have to create another WireGuard connection on router A for the site-to-site connection listening on port, say, 51821, or could I reuse the one running on 51820? If so, how could I "connect" router B to router A?

I have stumbled upon this tutorial: https://openwrt.org/docs/guide-user/services/vpn/wireguard/site-to-site, but I do not if it is aplicable when already existing a WireGuard interface on the WAN accesible router (A). Plus, I would like to learn how to do it by hand without scripting.

Thanks in advance.

2

It is applicable but you only connect from one side ( the side with the cgnat, as connection from the other side to cgnat is not possible)

Basically you setup both sides as "server"

Meaning opening up the firewall for the listen port and adding the wg interface to the lan zone.

On route allowed ips you add the wg address of the other side AND the lan subnet of the other side.

Do not forget to enable route allowed ips

3

On the machine with a public IP address:

config interface 'wg0'
	option proto 'wireguard'
	option private_key '[REDACTED]'
	option listen_port '51820'
	list addresses '172.16.0.1/32'

config wireguard_wg0 'wg0_sfg'
	option public_key '[REDACTED]'
	option preshared_key '[REDACTED]'
	list allowed_ips '172.16.0.0/24'
	list allowed_ips '192.168.128.0/17'
	list allowed_ips 'fdb1:f846:87e0::/48'
	option route_allowed_ips '1'
	option persistent_keepalive '25'

On the machine behind a CGNAT:

config interface 'wg0'
	option proto 'wireguard'
	option private_key '[REDACTED]'
	list addresses '172.16.0.2/32'

config wireguard_wg0 'wg0_srv'
	option public_key '[REDACTED]'
	option preshared_key '[REDACTED]'
	option endpoint_host '[REDACTED]'
	option endpoint_port '51820'
	list allowed_ips '172.16.0.0/24'
	list allowed_ips '192.168.0.0/17'
	list allowed_ips 'fdaf:5160:5d0f::/48'
	option route_allowed_ips '1'
	option persistent_keepalive '25'

For more info: