I love this config… stretching my boundaries of acceptance of normal networking of which I have no clue!!
So for anyone reading.
YES, perfectly OKAY to have multiple IP addresses per SINGLE WG interface and not only that have both client and server functions on a router on that single interface, as long as:
a. one ensures IP routes are adequate for the scenario
b. one ensures allowed IPs are adequate for the scenario
c. in this particular case both Routers have a public IP or an upstream modem/router can forward the listening port to the MT router.
Review RouterA
(1) Since Router A is client to Router B on the 255 address schema, I would prefer the address to be .2, vice .1 Just my personal preference/comfort level.
(2) WWW is not a secure method of accessing the router and thus would remove this …
set www port=8080
(3) The FIREWALL RULES and SOURCE NAT RULES are a hairy mess of paranoia and stuff that does not really work such as attempting to block youtube etc. WASTE OF TIME. My suggestions is to go back to default rules and only add what you need for traffic flow and use drop all else rules at end of input chain and forward chain.
(4) The input chain rule for wireguard seems strange, how can you have a src-address list if you are expecting remote users. They may log in from any Cellular provider or WIFI at a restaurant/hotel and thus going to be random??? That is the point of wireguard address structure, the initial handshake doesnt need to have a defined incoming source IP. Clearly from a security perspective its always better if you can do so, but just not expected here. Must be saying that your remote warriors are always coming from same ISP and thus what I would call “FIXED” remote users vice “MOBILE” remote users.
add action=accept chain=input comment=“13231 => Allow Wireguard” dst-port=
13231 in-interface=1-WAN log=yes log-prefix=
“13231 => Wireguard MT SkupnaListaDovoljenih” protocol=udp
src-address-list=SkupnaListaDovoljenih
In conclusion, for Router A, nothing wrong with your rules here for wireguard performance, If anything is causing issues on this router it would be the Firewall/sourcenat rule mess.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Router B
(4) Okay I dont understand why both RouterA and RouterB on their peer to peer settings think they are both clients???
You have to make up your mind. If Router B cannot act as the server, due to not having a publicly accessible IP address or one cannot forward the listening port from an upstream modem/router, then this will change things but ONLY at Router A.
Supposing Router B is supposed to be only the client then nothing need change at Router B. Normally the IP address for wireguard should be the subnet to allow any other devices attached to Router A be reachable or receivable but not necessary in this particular scenario.
Carrying this forward, at Router A, remove the keep alive setting as not required.
Seriously consider removing the second Wireguard address setup as its not required.
I thought the reason you had two was for the change of Server/Client releationship for a different connection.
If your concern is security, one can simply use firewall rules etc..
So perhaps a better explanation on your part can help figure out a better config.
( also messy firewall rules but a bit less crap for sure)
( same comment forget www address, its not secure method of accessing config )
