Re: wireguard and shorewall

Let's call the two ends A & B. Each has an 'outside tunnel' address via 
which they communicate with each other. These should be the 'Endpoint' for 
the far end in the respective conf files, together with the port that 
Wireguard listens on at the far end.

So, e.g. A's Endpoint should have B's outside tunnel address & wireguard 
port, and vice versa. 'ListenPort' on each should have the UDP port it 
listens on. I'm assuming you are OK with the public & private key settings.

The 'Address' setting at each end is its local address inside the tunnel 
together with the CIDR for that network appended.

AllowedIPs on each should list all the networks at the *other* end that this 
end should have access to.

So, for firewalling, the outside tunnel interface rules should allow 
connections to the other end's outside tunnel address/port. The wg0 
interface rules should allow connectivity to the networks in AllowedIPs.

HTH John


On 04/12/2020 15:47, Erich Titl wrote:
> Hi Folks
> 
> I am trying to set up a wireguard tunnel between two LEAF instances (7.0.0) 
> in my internal network.
> 
> I must be missing something fundamental as I don't see how the two wireguard 
> instances communicate with each other. They are physically connected to each 
> other using my internal network but having RFC1918 addresses of their own.
> 
> I was not able figure out how the Address line(s) on the wg0.conf file 
> corresponds to the remote station and what exactly needs to be set in the 
> shorewall config in this case.
> 
> cheers
> 
> ET
> 
> 
> ------------------------------------------------------------------------
> leaf-user mailing list: [email protected]
> https://lists.sourceforge.net/lists/listinfo/leaf-user
> Support Request -- http://leaf-project.org/
> 


------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/