Sorry cannot help on the openwrt side of the house but the RB5009 as a client wireguard device is straightforward.
WG Setup
WG settings
-Give WG interface a name, lets call it WG-Client
-Listen port NOT required
-Private key (internal use only)
-Public key (needed on Openwrt setup)
Peer settings
-Interface is WG-Client
-Public Key (provided by openwrt router)
-Endpoint WANIP of openwrt (best to use a dyndns name if not static)
-Enpoint port (the listening port set on the openwrt router)
-Allowed address: 192.168.9.0/24 {to be clear this setting says these are the allowable possible destination addresses to be used in the tunnel}
-Pesistent keep alive set at your preference aka 35 seconds for example
IP ADDRESS for wireguard interface NOT REQUIRED
IP Route REQUIRED, to ensure all traffic for work lan is sent through the wg tunnel.
/ip route (almost)
add dst-address=0.0.0.0/0 gateway=WANgatewayIP (either manually entered or done through client settings)
add dst-address=192.168.9.0/24 gateway=WG-Client
To prevent any potential leakage of requests to go through the MT client Router WAN side, if and when the tunnel connection is down for any reason *********, it is best to use a route rule approach and thus the final config would look like.
add dst-address=0.0.0.0/0 gateway=WANgatewayIP (either manually entered or done through client settings)
add dst-address=192.168.9.0/24 gateway=WG-Client routing-table=USETUNNEL
Route Rule
Source address=192.168.88.0/24
Action: Lookup Only in Table
Table: USETUNNEL
++++++++++++++++++++++++++++++++++++++
******* (courtesy of Sindy).
The hierarchy of routes was unclear (as I was not quite sure how to ensure the route to the tunnel would be matched or take prioirity over the standard route already on the router since there would be overlap!!!
(since 0.0.0.0/0 (the standard route) also covers the IP addresses 192.168.9.0/24)
Priority goes by…
- Route-Mark, has the highest priority
- Next, among all routes with the same routing-mark and matching the destination address of the packet, the system looks for one with the longest prefix in dst-address
In this case 192.168.9.0/24 describes a longer prefix than 0.0.0.0/0. (24 vs 0, I think)
- Finally, distance can be used, if all of the above are identical, a lower distance will ensure one route is matched before the other…
The question remains, how to ensure when the tunnel is down 192.168.9.0/24 doesnt leak out elsewhere.
I note on 7.0X beta RC whatever, the use of PROHIBIT and BLACKHOLE are no longer available.
I had thought that this would work.
0.0.0.0/0 gateway=wanipgateway {main table} distance=default
192.168.9.0/24 gateway=WG {main table} distance=default ( any destination due to the longer preference here would take precedence as required)
192.168.9.0/24 type=blackhole distance=default +1 (when the tunnel was down no leakage could occur to the client WANIP)
However, blackhole is like DROP in firewall rules, no indications to LAN users there is a problem just no results.
Thus like reject, PROHIBIT would provide at least an error message return.
0.0.0.0/0 gateway=wanipgateway {main table} distance=default
192.168.9.0/24 gateway=WG {main table} distance=default ( any destination due to the longer preference here would take precedence as required)
192.168.9.0/24 type=prohibit distance=default +1
As stated, blackhole and prohibit are not available and thus one is left with the one clear SOLUTION:
/ip route
add dst-address=0.0.0.0/0 gw=wanIPgateway {standard route either manually entered or by ip client checkbox}
add dst-address=192.168.9.0/24 gw=wg-client routing-mark=USETUNNEL
/ip route rule
source-address=192.168.88.0/24
action: Lookup-Only-In-Table
table=USETUNNEL