Two routers connected via WG through a VPS.
Router 1 can ping Router 2 and the devices behind it.
Router 2 can ping Router 1 and the devices behind it.
But the devices behind Router 2 can't. The settings identical on both sides, and wg peer allowed-address=0.0.0.0/0. Routes to the networks are present.
On Router 2:
mangle prerouting shows ping
mangle forward does NOT show ping
mangle input does NOT show ping
That is, the packet is lost at router decision and doesn't leave the router. Conntracker not show this icmp connection.
Last time in this situation, I changed the rp-filter from strict to loose. Now it's set to loose, of course. But nothing helps.
I can't show the entire configuration, but I'd appreciate any leading questions.
On router 2, you could apply a masquerade/src-nat rule for traffic that leaves via the wg interface.
If that still only gets there from Router2, likely means something odd.
Is router2 the default gateway for the devices behind it. If not, need to have a route to router1 using dhcp options or a redirect on main gateway, etc. (Note: If main gateway just forwards the packets back into lan towards router2, will likely wind up with triangle routing which stateful firewalls don't like, same at other end)
Seems you have different subnets behind one router or the other.
Make sure you push the route of the "other" subnet to the client on wireguard.
Of ourse, if you send us the configuration of your 2 routers, we'll be able to help more.
Seems you have different subnets behind one router or the other
Router1 lan is 10.20.30.0/24, Router2 is 10.20.32.0/24. WG subnet 10.10.10.0/24. As said, allow-adresses=0.0.0.0/0 on both wg clients, because WG used as site2site and VPN to main VPS (and others) too.
On router 2, you could apply a masquerade/src-nat rule for traffic that leaves via the wg interface.
All external interfaces (lte, ether-wan, wg) in list, that uses masquarade.
That is correct, but your Wireguard client does not know where to route the traffic to. You need to say that subnet 10.20.30.0/24 is reachable via router1 IP address, subnet 10.20.32.0/24 via Router2 IP Address to the client. And you need to make sure the route back is also working, means that the 10.10.10.0/24 subnet should point to the router that handles wireguard if it is not in the same subnet.
I had the idea to do the same in the past, but in the end I created a large subnet, bridged all router main interfaces together and each of these these interfaces had one IP of the subnet. 3 routes -> 10.0.0.254 (outgoing router), 10.0.0.253 and 10.0.0.252 were the 2 other routers. This way, you don't have to deal with the "routing" on the wireguard client side.
With risk of repeating myself, no configuration posted leads to speculation and playing Madam Zara the Fortune-Teller. That's why you should export it and share a redacted version of it here
I used WG as reseved VPN when main site2site (router1<>router2) IKEv2 not available. But activated tunnel policy between 10.20.30.0 and 10.20.32.0 break routing decision. If ike policy switched off, pings from router2 lan works well.
What can I do to got my scheme work? Monitoring by scheduler active ike2 peer and when it does down, disable pocily? Any other funny option?
IPsec has a knack for encrypting almost everything it deems worthy (matches the IPsec policies). To bypass this for WG, a masquerade rule for it should exist before the default one: