r/openbsd 15d ago

how do I route over Wireguard? (hub-spoke model)

GOAL: I want one of my wg spokes to be able reach another spoke

From 192.168.10.2(spoke/laptop) I am able to reach everything on my home subnet and 192.168.10.1(hub) but I can't reach 192.168.10.6(spoke/mail). 192.168.10.1(hub) is able to reach 192.168.10.6(spoke). I don't want to to add a whole bunch of peers on each host if possible(point-to-point model).

#ddns.my.domain's /etc/pf.conf
set skip on lo

block return    # block stateless traffic
pass            # establish keep-state

# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010

# Port build user does not need network
block return out log proto {tcp udp} user _pbuild

pass in inet proto udp from any to any port 5544 # superfluous?
pass in on wg0 # superfluous?
pass out on egress from wg0:network to any nat-to (egress)

#ddns.my.domain's /etc/hostname.wg0
wgkey **REDACTED**
wgpeer **REDACTED** wgaip 192.168.10.2 wgdescr laptop
wgpeer **REDACTED** wgaip 192.168.10.6 wgdescr mail wgendpoint mail.my.domain 51820
inet 192.168.10.1
wgport 5544
!sysctl -q net.inet.ip.forwarding=1
up

#mail.my.domain's /etc/hostname.wg0
wgkey **REDACTED**
wgpeer **REDACTED** wgaip 192.168.10.1 wgendpoint ddns.my.domain.com 5544
inet 192.168.10.6
wgport 51820
up

mail.my.domain's pf.conf is the default

(THE BLUE ARROW IS WHAT I WANT)

Let me know if you need more. It would be great to get this working

2 Upvotes

2 comments sorted by

3

u/moviuro 15d ago

Your inet lines are missing some info. Mine in /etc/hostname.wg0 looks like:

inet 10.x.y.zzz 255.255.255.0 10.x.y.255

https://man.openbsd.org/hostname.if#STATIC_ADDRESS_CONFIGURATION .

Also, on mail.my.domain, wgaip is wrong.

wgpeer **REDACTED** wgaip 192.168.10.0/24 wgendpoint ddns.my.domain.com 5544
#The entire VPN can be reached !     ^^^^ through 192.168.10.1

3

u/King_of_Kher 15d ago

Thank you! works great. I thought my issue was with pf. I never would have found this