Routing Internet-Bound Traffic Between Two WireGuard Peers

Title: Configuring Network and Internet-Bound Traffic with WireGuard Peers

In this article, we will discuss how to configure a WireGuard VPN setup for two houses (House1 and House2) connected via the internet, with routers acting as intermediaries for the network and internet-bound traffic.

Prerequisites

• WireGuard installed on both routers
• Static IP addresses for both routers
• Public keys for both routers
• Shared private key for both routers

Setting Up WireGuard on Each Router

1. House1 Router

   sudo wg genkey | tee house1-private-key | wg pubkey > house1-public-key
   

   Edit the WireGuard configuration file (/etc/wireguard/wg0.conf) and add the following:

   [Interface]
   Address = <House1-Static-IP>
   ListenPort = 51820
   PrivateKey = (paste house1-private-key here)
   SaveConfig = true
   
   [Peer]
   PublicKey = (paste House2-Public-Key here)
   Endpoint = <House2-Public-IP>:51820
   AllowedIPs = 0.0.0.0/0
   

   Start the WireGuard service:

   sudo systemctl start wg-quick@wg0
   

2. House2 Router

   Repeat the steps for House1, but use House2's static IP, private key, and public key.

Configuring Internet-Bound Traffic

To ensure that internet-bound traffic is routed through the VPN, follow these steps on both routers:

1. House1 Router

   Add the following to the /etc/sysctl.conf file:

   net.ipv4.ip_forward=1
   

   Then, run:

   sudo sysctl -p /etc/sysctl.conf
   

   Also, add the following to the /etc/iptables/rules.v4 file:

   iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
   iptables -A FORWARD -i eth0 -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT
   iptables -A FORWARD -i wg0 -o eth0 -j ACCEPT
   

   Save and exit the file, then run:

   sudo iptables-save > /etc/iptables/rules.v4
   

2. House2 Router

   Repeat the steps for House1, but use the appropriate interface names (eth0 for House1, and the LAN interface for House2).

Testing the Setup

1. On a device connected to House1, ping a device on House2's network:

   ping <Device-IP-on-House2>
   

   If the ping is successful, the VPN setup is working correctly.

Summary

• WireGuard is a fast, modern, and secure VPN solution that can be used to connect two houses via the internet.
• Each router needs WireGuard installed, a static IP address, public and private keys, and the shared private key.
• Configure the WireGuard interfaces, set up internet forwarding, and create iptables rules on both routers.

References

• WireGuard
• WireGuard for Linux
• Configuring WireGuard for IPv4
• Configuring IP Forwarding on Ubuntu
• Configuring iptables on Ubuntu