Two sites
Join two sites' private LANs across the internet with WireGuard on VyOS: keys and peers, the AllowedIPs mistake and what it teaches, what the internet actually sees, and the tunnel's smaller MTU.
By the end you will be able to:
- Explain why private networks need a tunnel to cross the internet
- Generate WireGuard keys and configure a peer on VyOS
- Explain AllowedIPs as both a routing table and an access list, and diagnose 'Required key not available'
- Show what an observer on the internet can see
- Explain the tunnel MTU and how MSS clamping protects TCP
Prerequisites: Setting up VyOS with NAT
Two offices, each with its own internet connection, want their LANs to talk as if they were one network. The internet won't carry private addresses (10.1.0.0/24 and 10.2.0.0/24 here), so traffic between them has to travel inside a tunnel: each packet is encrypted and wrapped in a new packet addressed from one office's public address to the other's.
WireGuard is the modern way to build that tunnel: a few lines of configuration, strong cryptography with no options to get wrong, and very little overhead. It's built into the Linux kernel, and so into VyOS.
The lab has two VyOS routers. R1 is at site A (WAN 203.0.113.2, LAN 10.1.0.0/24) and R2 at site B (WAN 198.51.100.2, LAN 10.2.0.0/24). Between them is an "internet" router that knows only the two WAN links. At the start, a host at site A can't reach site B at all, which is exactly what the real internet does with private addresses. Every output comes from that lab.
- No tunnel: private addresses go nowhere. The internet has no route to 10.2.0.0/24, so host A's packets are dropped.
- Handshake. R1 and R2 exchange keys over UDP 51820 between their public addresses.
- Encrypted and wrapped. Host A's packet to host B is encrypted by R1 and sent inside UDP from 203.0.113.2 to 198.51.100.2. The internet sees nothing else.
set system host-name 'R1'
set interfaces ethernet eth0 address '203.0.113.2/30'
set interfaces ethernet eth0 description 'WAN'
set interfaces ethernet eth1 address '10.1.0.1/24'
set interfaces ethernet eth1 description 'LAN-SITE-A'
set protocols static route 0.0.0.0/0 next-hop '203.0.113.1'- Lines 2–3: The public side.
- Lines 4–5: Site A's LAN.
- Line 6: Everything else to the internet.
root@hosta:~# ping -c 2 -W 2 10.2.0.10
PING 10.2.0.10 (10.2.0.10) 56(84) bytes of data.
--- 10.2.0.10 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1009ms- Line 5: Private addresses don't cross the internet.