Source: https://twitter.com/lindworm/status/1451878726807998467
We assume here, that all nodes are running Linux. IP Forwarding will be enabled on all routing nodes. The config files should be named after the name of the VPN. Wireguard will name the VPN interface after the file.
Every node needs to know the route to the foreign nets. We can either add them manually or let our main router (the one that points to 0.0.0.0) know that the corresponding net is behind a VPN router.
So we need to point the route to the foreign net to the local address of the upstream VPN router.
-
On Fritz!Box: Heimnetz -> Netzwerk -> Netzwerkeinstellungen -> Statische Routingtabelle
-
Route example for reaching net B via
router_location_Awith local IP192.168.111.100:$ ip route add 192.168.155.0/24 via 192.168.111.100
-
List all
iptablesrules$ iptables --list-rules $ iptables --list-rules --table nat $ iptables --flush $ iptables --flush --table nat
-
Turn on
iptableslogging$ iptables --append INPUT --jump LOG $ iptables --append OUTPUT --jump LOG $ iptables --append FORWARD --jump LOG $ iptables --append PREROUTING --table nat --jump LOG
-
Turn off
iptableslogging$ iptables --delete INPUT --jump LOG $ iptables --delete OUTPUT --jump LOG $ iptables --delete FORWARD --jump LOG $ iptables --delete PREROUTING --table nat --jump LOG
Thanks for the feedback. I'm not using this setup anymore; tailscale is far too easy ;-)