Setting Wireguard for enabling remote access to a SOHO DMZ service

Dimitar Vassilev dimitar.vassilev at
Wed Aug 14 13:42:30 CEST 2019

Dear Wireguard users and developers,

I'm in the planning phase of enabling remote access to a SOHO DMZ service
for myself and a few peers. I would appreciate if you could help me clear
the uncertainties before me on the drawing board /implementation level.
My setup is:

   - LibreCMC 1.4.8 with latest stock wireguard from the LibreCMC repo. The
   router is being fed with Internet by DHCP from my ISP.
   - DMZ network hosting the service - /24. Say
   - Internal LAN - /24, fed by the internal DHCP. Say
   - default route  -  say
   - DMZ firewall zone. Only outgoing DMZ traffic is allowed for the time
   - LAN firewall zone. outgoing traffic to wan + DMZ is allowed
   - NAT-traversal
   - DynDNS
   - Peer with "public" /24 network -

What I would like to achieve is

   - Setup a wireguard interface in the same DMZ network range or a subset
   of it
   - Port-forward the wireguard traffic from my peer to the DMZ wireguard
   VPN entry-point for the particilar service
   - Route the rest of the traffic unencrypted

I've checked the manual and quick deployment guide and would appreciate
your feedback on doing the things in the proper way. The specific questions
I have are:

   - Is it a good idea to put the wg interface in the same network range as
   the DMZ or should I split the DMZ into 2 x /25 networks or pick a separate
   wireguard network
   - Given that I'm assigned a default route via DHCP, should I create
   custom static routes like in the example below on the command line

              # ip route add via dev eth1

or should I leave this up to the routing daemons to decide themselves? I'm
still mixing up the concepts of the different VPN implementations. I also
see by web searching that in LuCI I got a checkbox to resolve my problems
with routing the private networks.

Thanks for your comments and feedback!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the WireGuard mailing list