Using WG to route between two LANs

Dashamir Hoxha dashohoxha at
Wed Oct 28 04:39:01 CET 2020

On Wed, Oct 28, 2020 at 4:22 AM Samuel Holland <samuel at> wrote:
> Hello,
> On 10/22/20 10:43 AM, Dashamir Hoxha wrote:
> > I have created a network as shown in this diagram:
> >
> >
> > The red arrows show the WG connections. Only the server has a public IP.
> > From client1 I can ping to the internet and also to client4: `ping`
> > However I cannot ping to the LAN IP of client4: `ping`
> >
> > My ultimate goal is to be able to ping from client2 on LAN1 to client5 on LAN2
> > (both of which have no WG configuration and interface), routing through
> > the WG network (client1 --> server <-- client4).
> >
> > Is this possible? I think that it should work, with proper routing,
> > but I am not able
> > to figure out the proper configurations. Has anybody tried something like this?
> > Do you have any suggestions or advice?
> Yes, this is possible. You need:
>  - LAN1 needs to be in the AllowedIPs for client1 on the server
>  - LAN2 needs to be in the AllowedIPs for client4 on the server

Thanks Samuel. Actually I figured out that I was missing this (LAN1 on
AllowedIPs for client1 on the server, and LAN2 for client4).

>  - A route on client1 to LAN2: ip route add dev wg0
>  - A route on client4 to LAN1: ip route add dev wg0
>  - Routes on the server to both LANS (same as above)

Actually I am using `wg-quick` and it adds these routes automatically.

Instead, I have to add routes to clients on LAN1 and LAN2 that don't have
WG interfaces. For example on client2 and client3 I have to add:
`ip route add to via dev eth0`
And on client5 and client6 add the route:
`ip route add to via dev eth0`

> A gateway for the routes is not needed. Once Linux passes the packet to the
> WireGuard interface, cryptokey routing (AllowedIPs) is used.
> You do not need any NAT.

That's right. All the WG network seems  to work like a router.

> Cheers,
> Samuel

More information about the WireGuard mailing list