Is there a “rule” in theory where one would NEED to create a new wireguard interface (and new peer) instead of just adding another wireguard peer to an existing wireguard interface?
in my opinion:
-any s2s link via wireguard need create new interface
-roadwarrior clients can use one interface
Not rule at all.
Be extra careful making sure there are no overlaps in allowed addresses on peer settings … otherwise your WG interface will not know what to send to which peer.
It is usually when multiple peers are being used, that problems pop up (which did not reveal themselves when only using 1 peer on each end).
Generally dedicated site-to-site connections should be on different interfaces (but this is not carved in stone).
Out of convenience there are some throwing everything together but be aware convenience happens to be the biggest problem in everything related to security.
Road warriors are another thing, usually they all have the same needs/security settings so they can belong together.
For firewall etc it actually makes it a lot easier/manageable to use different interfaces.
Yes, if your device needs to go out internet in two different endpoints as was noted, OVERLAP??
Typical example is third party VPN, do I want to go out proton vienna or proton uk
Each gets 0.0.0.0/0 in the peer settings and thus a separate interface is required.
The IP address in this case would be identical funny enough, but the endpoints will differ and probably keys.
The above is for a peer client router at handshake
However the same applies at the MT as a server peer for handshake, where all the client peers are identified by /32 settings and potentially any remote subnets if other routers are involved.
The minute there is a requirement to put 0.0.0.0/0 ( to go out internet on a client peer router ) you are in second interface territory immediately.
so why wouldn’t someone decide to create an interface coupled with a peer?
15 peers 15 interfaces…
Would it have a drawback in terms of speed?
Would it run smoother if it would be possible to use 1 interface with 15 peers?
1 interface needs to have at least 2 peers (one at each end).
Or there is no interface … at least not a usable one.
Speedwise not that much of an issue but the “pivot point” (=router where everything will terminate on) obviously has an impact.
E.g. using hAP Lite as pivot or RB5009 makes a HUGE difference (disregarding fact one as Fast Ethernet ports and the other can use SFP+ up to 10Gb).
Wireguard is all CPU. Nothing is HW offloaded. Yet even then (given same HW) WG is faster then any other VPN.
Good question.
What is faster
a. 1 interface with 15 peer clients and one IP address
b. 1 interface with 7 clients using one IP address and 8 clients using a second IP address
c. 15 different interfaces…
I would hazard a guess that a. and b. are better handled by the router than c.