<div dir="ltr"><div class="gmail_quote"><div dir="ltr">Ah alright thanks for the info, I finally figured out everything by myself though I still have one small problem.<div><br></div><div>For reference, here's everything I have done:</div><div><br></div><div><begin></div><div><br></div><div><div>Isolated VM's DHCP: <a href="http://172.16.1.0/16" target="_blank">172.16.1.0/16</a></div><div><br></div><div>Switch wg0: <a href="http://172.16.0.2/30" target="_blank">172.16.0.2/30</a></div><div>Switch ens3: <a href="http://172.16.1.1/16" target="_blank">172.16.1.1/16</a></div><div>Switch ens2: 192.168.2.xx/24 gw <a href="http://192.168.2.254/24" target="_blank">192.168.2.254/24</a></div><div><br></div><div>Router wg0: <a href="http://172.16.0.1/30" target="_blank">172.16.0.1/30</a></div><div>Router eth0: <a href="http://35.224.54.65/32" target="_blank">35.224.54.65/32</a></div><div><br></div><div># both machines</div><div>echo "deb <a href="http://deb.debian.org/debian/" target="_blank">http://deb.debian.org/debian/</a> unstable main" > /etc/apt/sources.list.d/<wbr>unstable-wireguard.list</div><div>printf 'Package: *\nPin: release a=unstable\nPin-Priority: 150\n' > /etc/apt/preferences.d/limit-<wbr>unstable</div><div>apt update</div><div>apt-get install -y linux-headers-$(uname -r) wireguard</div><div><br></div><div># both machines /etc/sysctl.conf</div><div>net.ipv4.ip_forward=1</div><div>net.ipv4.conf.all.proxy_arp = 1</div><div><br></div><div># post up (ens3 of switch) and (eth0 of router) run (wg-quick up wg0)</div><div><br></div><div>####isc-dhcp-server (on switch ens3):</div><div>option domain-name "pcr";</div><div>option domain-name-servers 8.8.8.8, 8.8.4.4;</div><div><br></div><div>default-lease-time 600;</div><div>max-lease-time 7200;</div><div><br></div><div>ddns-update-style none;</div><div><br></div><div>authoritative;</div><div><br></div><div>subnet 172.16.0.0 netmask 255.255.0.0 {</div><div> range 172.16.1.2 172.16.255.253;</div><div> option routers 172.16.0.1;</div><div>}</div><div><br></div><div>############### lan vm /etc/wireguard/wg0.conf</div><div>[Interface]</div><div>PrivateKey = *************</div><div>ListenPort = 12345</div><div>Address = <a href="http://172.16.0.2/30" target="_blank">172.16.0.2/30</a></div><div>PostUp = ip route add <a href="http://172.16.0.1/32" target="_blank">172.16.0.1/32</a> via 172.16.0.2 dev wg0 ; route del default gw 192.168.2.254 ; ip route add 192.168.2.254 dev ens2 ; route add default gw 172.16.0.1 dev wg0 ; ip route add 35.224.54.65 via 192.168.2.254 ; iptables -A FORWARD -i ens3 -o wg0 -j ACCEPT ; iptables -A FORWARD -i wg0 -o ens3 -j ACCEPT</div><div><br></div><div>[Peer]</div><div>PublicKey = *************</div><div>Endpoint = <a href="http://35.224.54.65:12345" target="_blank">35.224.54.65:12345</a></div><div>AllowedIPs = <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a></div><div>PersistentKeepalive = 1</div><div><br></div><div><br></div><div>############### google vm /etc/wireguard/wg0.conf</div><div>[Interface]</div><div>PrivateKey = *************</div><div>ListenPort = 12345</div><div>Address = <a href="http://172.16.0.1/30" target="_blank">172.16.0.1/30</a></div><div>PostUp = ip route add <a href="http://172.16.0.2/32" target="_blank">172.16.0.2/32</a> via 172.16.0.1 dev wg0 ; ip route add <a href="http://172.16.0.0/16" target="_blank">172.16.0.0/16</a> via 172.16.0.2 dev wg0 ; iptables -A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT ; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE ; iptables -A FORWARD -i wg0 -j ACCEPT</div><div><br></div><div>[Peer]</div><div>PublicKey = *************</div><div>AllowedIPs = <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a></div></div><div><br></div><div><end></div><div><br></div><div>Now the problem I face: whenever I run 'wg-quick up wg0' on a Google Cloud Engine VM, I can't SSH to it anymore from the WAN side, but the weird thing is, from the 'switch' I can ping the router just fine, they have a connection, I can even SSH (sometimes not).</div><div><br></div><div>Now what's weird is, when I do all configuration steps with commands (ip .. wg set .. blabla), and make it with those commands just like the config, everything works fine. so I have a script that just does the commands.. but wg-quick should work, everything is the same. Yet this happens.. anything I can do to debug this behaviour?</div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On 25 January 2018 at 12:08, Jason A. Donenfeld <span dir="ltr"><<a href="mailto:Jason@zx2c4.com" target="_blank">Jason@zx2c4.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">WireGuard is layer 3, not layer 2, so bridging is not what you want.<br>
<br>
Instead, do ordinary IP routing between different subnets. As you<br>
appear to already have different subnets, this shouldn't be a problem.<br>
<br>
If you'd like to overlap within the same subnet, there's always proxy<br>
arp, but I'd caution against that approach.<br>
<br>
Lots of people run into this confusion about layer 2 vs layer 3. We<br>
can probably walk you through getting things rolling for your<br>
particular setup in #wireguard on Freenode, if you have IRC.<br>
<span class="m_3536533898149672631HOEnZb"><font color="#888888"><br>
Jason<br>
</font></span></blockquote></div><br></div>
</div></div></div><br></div>