wireguard nerozlisuje client a server. Vsetky wireguard interfaces su peers. V praxy to znamena, ze ak vytvaras wireguard VPN medzi dvoma peers a oba maju nemennu verejnu IP addresu, tak potom v konfiguracii oboch budes mas "option endpoint_host .
Wireguard protocol vsak ma sikovnu feature, ze si pamata z akej verejnej IP adresy mu dosiel paket. Toto umoznuje, ze staci ak jeden z peers ma verejnu IP adresu. Tym padom tento peer nebude mat v konfiguracii IP adresu toho druheho, ale ziska ju dynamicky akonahle mu druhy peer posle paket.
Kedze pises, ze v praci uz pouzivate wireguard VPN na pristup do prace, tak to znamena ze v praci mate wireguard peer s nemennou verejnou IP adresou.
na tvojom domacom turris omnia router-i ti staci mat podobny config v /etc/config/network:
config interface ‘wg0’
option proto ‘wireguard’
option private_key ‘WKqQlwu7sza3DG6bD8Sdksa97eRePIRbheSS4GGloFk=’
option listen_port ‘1234’
list addresses ‘192.168.88.2/24’
list dns ‘192.168.68.1’
config wireguard_wg0
option public_key ‘kbKWrsbYSXQfif4rUUCi9UHGW0IZBmkF15SlpiVfDc=’
option preshared_key ‘B3rSRmoOnFGHklsjdjs7TkffU4Rdlg5t0YcGKJzld001bZ8=’
option route_allowed_ips ‘1’
list allowed_ips ‘0.0.0.0/0’
option persistent_keepalive ‘25’
option description ‘praca’
option endpoint_host ‘100.1.2.2’
option endpoint_port ‘1234’
kde
list addresses ‘192.168.88.2/24’ je IP adresa na wireguard interface-u na tvojom turrise
list dns urcuje nameserver v praci
list allowed_ips mozes obmedzit iba na siete v praci ak chces pouzivat split tunneling.
option endpoint_host je verejna IP adresa v praci
a samozrejme wireguard v praci musi byt nakonfigurovany tiez pre tvojho turris peer-a doma. Minimalne config pre wireguard peer tvojho turris-u musi obsahovat jeho public_key, preshared_key a zoznam povolenych IP addries, napr iba IP adresa NAS, alebo celej tvojej domacej LAN.
Nezabudni, ze musis povolit aj firewall v /etc/config/firewall. Napr.
config rule
option name ‘Allow-Wireguard-Inbound’
option target ‘ACCEPT’
option src ‘*’
option proto ‘udp’
option dest_port ‘1234’
kde
option src mozes obmedzit na verejnu IP z prace.
port musis mat ten isty ako vo wireguard interface config-u.
a tiez ak mas definovanu zonu pre wireguard, tak potrebujes forwardovanie medzi zonami
config zone
option name ‘wg’
list network ‘wg0’
list network ‘wg_proton’
option input ‘ACCEPT’
option output ‘ACCEPT’
option forward ‘ACCEPT’
option masq ‘1’
config forwarding
option src ‘wg’
option dest ‘wan’
config forwarding
option src ‘wan’
option dest ‘wg’
config forwarding
option src ‘lan’
option dest ‘wg’
config forwarding
option src ‘wg’
option dest ‘lan’
V neposlednom rade nezabudni na routovanie. Aj ked tunel bude funkcny, co si vies overit prikazom wg, neznamena, ze bude routovat automaticky. Wireguard toto neriesi. Musis si teda pridat na omnii do routovacej tabulky routes smerom do prace, a tiez v praci musis zabezpecit routovanie smerom do tvojej domacej siete.
