OFC #WireGuard may have done so since there are some #ISPs that do #CGNAT + #Tunneling i.e. [#L2TP on #DSL is common in #Russia to prevent people from 'blueboxing' by splicing the phone line]...
And in some Corporate setups this may even be desireable to have all the remote workers not able to #P2P as to mitigate #malware propagation...
Not sure about wg-quick, but in all of the wireguard setups I've used you have to have the vpn-external IPs in the AllowedIPs list (i.e. if I have two boxes using 172.31.0.1 and 172.31.0.2 to vpn to each other, and they route traffic for 10.0.0.0/24 on one side and 10.1.0.0/24 on the other, then AllowedIPs has to contain all three ranges, IIRC (this assumes you aren't NAT'ing or anything like that)).
Also, if 10.0.0.0/24 and 10.1.0.0/24 want to reach each other, they need to have a route to the 172.31.0.X boxes so they know where to send traffic destined for the other side.
#pfSense & #OPNsense do make these default routes most of the time but if you manually setup some #Routing on a #Linux box to do that, you may need to adjust all these parts on your own.
Add comment