Allowed-Ips do not get set correctly about wg-portal

[h44z]

I see. So it is currently not supported to specify the allowed IP's of peers in the server config. I will have to add this feature to wgportal.

[h44z]

@p-rintz can you test the latest docker image if your usecase works now? I have added a extra field called "Extra Allowed IPs (Server sided)" to the peer configuration screen.

[h44z]

Hi,

I have a few more questions here.

• Are we talking about a WireGuard setup in "server" mode or in "client" mode?
• Have you set the Allowed-IPs for a peer/endpoint or in the interface settings screen (default allowed IP's)?

So to (hopefully) clarify this a bit, if you are in "server" mode, the Allowed-IPs for the peers will be set to the peer's Client IP address. The Allwed-IPs in the peer settings screen are only used for the Peer configuration that can be used for client deployment.

Maybe it helps if you post the generated wgX.conf file of the interface (you can download that in the UI) and/or the generated peer.conf. You can also share the data you entered in the UI in order to reproduce the results. Make sure that no private data is included in the conf file! Thanks.

[p-rintz]

Thanks for the quick answer.

Its in server mode. So what you wrote below explains what Im seeing then.

Im trying to have this Wireguard Server be the entry-point to my home network (which is why It needs the 10.1.0.0/24 subnet as allowed-ips for one of the clients)

If I set it to client mode, will I still be able to create other peers, connect via the server etc?

# AUTOGENERATED FILE - DO NOT EDIT
# -WGP- Interface: wg0 / Updated: 2021-06-15 08:53:39.260933598 +0000 UTC / Created: 2021-06-07 23:07:07.650077182 +0000 UTC
# -WGP- Interface display name: 
# -WGP- Interface mode: server
# -WGP- PublicKey = Key

[Interface]

# Core settings
PrivateKey = Key
Address = 10.8.0.1/24

# Misc. settings (optional)
ListenPort = 51820
MTU = 1370
SaveConfig = true

# Interface hooks (optional)
PreUp = sysctl -w net.ipv4.ip_forward=1; sysctl -w net.ipv6.conf.all.forwarding=1
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -A FORWARD -i %i -j ACCEPT; ip6tables -A FORWARD -o %i -j ACCEPT; ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip r add 10.1.0.0/24 via 10.8.0.2
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -D FORWARD -i %i -j ACCEPT; ip6tables -D FORWARD -o %i -j ACCEPT; ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

#
# Peers
#


# -WGP- Peer: iPhone / Updated: 2021-06-15 18:23:40.446463799 +0000 UTC / Created: 2021-06-08 00:08:59.967857445 +0000 UTC
# -WGP- Peer email: [email protected]
# -WGP- PrivateKey: Key1
[Peer]
PublicKey = Key1
PresharedKey = Key1
AllowedIPs = 10.8.0.3/24

# -WGP- Peer: OPNsense / Updated: 2021-06-15 18:24:20.585264131 +0000 UTC / Created: 2021-06-07 23:31:39.685499407 +0000 UTC
# -WGP- Peer email: [email protected]
# -WGP- PrivateKey: Key2
[Peer]
PublicKey = Key2
PresharedKey = Key2
AllowedIPs = 10.8.0.2/32
PersistentKeepalive = 16

# -WGP- Peer: ArbeitsLaptop / Updated: 2021-06-15 18:26:12.063591338 +0000 UTC / Created: 2021-06-08 08:40:06.177190588 +0000 UTC
# -WGP- Peer email: [email protected]
# -WGP- PrivateKey: Key3
[Peer]
PublicKey = Key3
PresharedKey = Key3
AllowedIPs = 10.8.0.4/32
PersistentKeepalive = 16

[h44z]

So this WireGuard server is running at your home (which has the 10.1.0.0/24 subnet) and you want your clients to be able to connect to your home network? This should work perfectly fine with the server config you posted above. Simply add the 10.1.0.0/24 to your clients as allowed IP's (just add 10.8.0.0/24, 10.1.0.0/24, 0.0.0.0/0 for example, skip the 0.0.0.0/0 if you don't want all traffic to be routed over the vpn).

You then get something like:
10.1.0.0/24 ---- 10.8.0.1 ---- 10.8.0.0/24
Where your clients have 10.8.0.x IP's and a route to the 10.1.0.0/24 network.

[p-rintz]

No. Its running in the Cloud and Im connecting to it, while the Cloud Server has a Wireguard connection to my Home.

Im planning on using WG-portal as a mobile VPN, while also granting access to my home automation.

The Cloud WG-Portal Server routes the traffic to 10.8.0.2 which is my Home Router.

If I do not add the 10.1.0.0/24 to the allowed-ips on the WG-Portal server, it will throw the typical Wireguard errors.

On the home router side, I have 0.0.0.0/0 in the allowed-ips (for now).

[p-rintz]

Yeah, that works perfectly. Thank you.