Access webgui only from inside wireguard network ?

[joomlafab]

Hi !

I've got a remote/independant wireguard VPN server. I can set up a wireguard client in the VPN section of my AX86UPro, and with VPN Director I can add rules so that some machines on the network use it.

Now I wonder if it's possible (and how) to set up a rule so that the webgui would be reachable from machines on the same vpn network.

Let's say my wireguard client conf looks like that

[Interface]
PrivateKey = ***
Address = 10.0.0.25/32

[Peer]
PreSharedKey = ***
PublicKey = ***
AllowedIPs = 10.0.0.0/24
Endpoint = xx.yy.zz.tt:51820
PersistentKeepalive = 25

For instance, could I set a rule in VPN Director with my wireguard client as interface, and the router IP (192.168.50.1) as Local IP ? I'm a little scared to lock myself out of the webgui....
In the client conf, obviously the kill switch would be off because I still want to access the webguy from local network, but what about the firewall ? Should it be off ? Is it safe ?

The idea would be that my router is not open on WAN, but can be reached from any machine on my VPN network 10.0.0.0/24.

If anyone has already done that, please explain me !

 

[ZebMcKayhan]

Now I wonder if it's possible (and how) to set up a rule so that the webgui would be reachable from machines on the same vpn network.

The easiest way would be to set the vpn option "Inbound firewall" to allow. But this would at the same time give access to your lan from vpn which you perhaps don't want? If not custom firewall rules may be required.

what about the firewall ? Should it be off ?

No, never turn it off if router is connected to internet.

 

[ZebMcKayhan]

For instance, could I set a rule in VPN Director with my wireguard client as interface, and the router IP (192.168.50.1) as Local IP ? I'm a little scared to lock myself out of the webgui....

If you don't plan on using the vpn connection for internet data, the only vpndirector rule you need is whatever you put in AllowedIPs as "remote ip". Like:
Local Ip: leave blank
Remote Ip: 10.0.0.0/24

This would provide both lan and router to find a route to 10.0.0.0/24 network over vpn.