VPN Director question

[elorimer]

I'm moving my setup from OpenVPN to Wireguard and have stumbled. I have an AX-88U setup with an OpenVPN server and a Wireguard server, and an Ax-86Pro setup with two OpenVPN clients and one Wireguard client. On the client side I want traffic (a) to or from the AX-88U LAN to go over the VPN, (b) and other traffic to go over the WAN, (c) except for one device, a TV, that I want always to go over the VPN.

Using OpenVPN or Wireguard (a) and (b) work fine, but (c) works for OpenVPN but not Wireguard. More specifically, looking at the table below, if I activate Rule #2 and deactivate Rule # 6, all traffic from 192.168.10.120 goes over the OpenVPN tunnel. But if I deactivate Rule #2 and activate Rule #6, all traffic going to the internet is routed over the WAN and not the Wireguard tunnel.

The Wireguard client has Allowed IPs of 10.6.0.0/24, 192.168.50.0/24, 0.0.0.0/24. What am I doing wrong?

NB: The site to site rule didn't work if "Local IP" was blank. I had to fill in the local IP range.

 

[ZebMcKayhan]

The Wireguard client has Allowed IPs of 10.6.0.0/24, 192.168.50.0/24, 0.0.0.0/24. What am I doing wrong?

0.0.0.0/24???

The AllowedIPs needs to contain ALL destinations possible to be reached over wg vpn. Since you have a single device that requires internet to go this way, just adjust it to 0.0.0.0/0.

Then take care of your rules in vpndirector accordingly (like you pretty much have done already)

LocalIP: blank, RemoteIP: 10.6.0.0/24 ,Iface: WGC1
LocalIP: blank, RemoteIP: 192.168.50.0/24 ,Iface: WGC1
LocalIP: 192.168.10.120, RemoteIP: blank, Iface: WGC1

Please note that having multple servers on same lan connecting from multiple clients on same lan could create a routing conflict on the server side.

 

[elorimer]

Thanks. Doh, I'm surprised I didn't put it down as 0.0.0.0/32. Staring at the wrong thing.

That fixed the problem with the single device. I hadn't been able to get the site to site working using blank for the local ip and had to fill in the local network, but it looks like that isn't necessary anymore either.

Yes, the VPN rules I'd been juggling til I fixed this, turning off clients and rules as I moved from one situation to another, but now I can turn off the openvpn3 client entirely.