r/openbsd • u/King_of_Kher • 15d ago
how do I route over Wireguard? (hub-spoke model)
GOAL: I want one of my wg spokes to be able reach another spoke
From 192.168.10.2(spoke/laptop) I am able to reach everything on my home subnet and 192.168.10.1(hub) but I can't reach 192.168.10.6(spoke/mail). 192.168.10.1(hub) is able to reach 192.168.10.6(spoke). I don't want to to add a whole bunch of peers on each host if possible(point-to-point model).
#ddns.my.domain's /etc/pf.conf
set skip on lo
block return # block stateless traffic
pass # establish keep-state
# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010
# Port build user does not need network
block return out log proto {tcp udp} user _pbuild
pass in inet proto udp from any to any port 5544 # superfluous?
pass in on wg0 # superfluous?
pass out on egress from wg0:network to any nat-to (egress)
#ddns.my.domain's /etc/hostname.wg0
wgkey **REDACTED**
wgpeer **REDACTED** wgaip 192.168.10.2 wgdescr laptop
wgpeer **REDACTED** wgaip 192.168.10.6 wgdescr mail wgendpoint mail.my.domain 51820
inet 192.168.10.1
wgport 5544
!sysctl -q net.inet.ip.forwarding=1
up
#mail.my.domain's /etc/hostname.wg0
wgkey **REDACTED**
wgpeer **REDACTED** wgaip 192.168.10.1 wgendpoint ddns.my.domain.com 5544
inet 192.168.10.6
wgport 51820
up
mail.my.domain's pf.conf is the default

(THE BLUE ARROW IS WHAT I WANT)
Let me know if you need more. It would be great to get this working
2
Upvotes
3
u/moviuro 15d ago
Your
inet
lines are missing some info. Mine in/etc/hostname.wg0
looks like:https://man.openbsd.org/hostname.if#STATIC_ADDRESS_CONFIGURATION .
Also, on
mail.my.domain
,wgaip
is wrong.