Learn WireGuard - Site-to-Site VPN

#Introduction

So far your tunnel has only connected two devices. Now we level up: connecting two networks — the office LAN subnets at two locations — so that devices at location A can talk to devices at location B as if they were on the same network.

Episode 9 covers site-to-site VPNs: choosing a topology, configuring two WireGuard servers at each site, arranging routing between subnets, and setting up the firewall rules that open the path between LANs. By the end of the episode, you will have two offices seamlessly connected.

#Choosing a Topology

#Full Mesh for Two Sites

For two sites, full mesh is the most direct choice: each site has the other site as a peer, and all inter-site traffic flows directly without an intermediary. With two sites, the configuration only needs one [Peer] on each side.

#Hub-and-Spoke for Many Sites

If there will be three or more sites later, consider hub-and-spoke: one site becomes the central hub, and all other sites connect only to the hub. Traffic between spokes is forwarded by the hub. This topology simplifies per-site configuration (only one peer), but adds latency because every packet passes through the hub. We cover the details in episode 11.

#Configuring Two Servers

#Address Scheme

Suppose office A uses the LAN 10.1.0.0/24 and office B uses 10.2.0.0/24. We allocate two tunnel addresses: 10.9.0.1 for office A's WireGuard gateway and 10.9.0.2 for office B.

#wg0.conf at Office A

[Interface]
Address = 10.9.0.1/30
ListenPort = 51820
PrivateKey = <kunci privat A>
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT
 
[Peer]
PublicKey = <kunci publik B>
AllowedIPs = 10.2.0.0/24, 10.9.0.2/32
Endpoint = 203.0.113.2:51820

AllowedIPs = 10.2.0.0/24, 10.9.0.2/32 means traffic to LAN B and to B's tunnel address goes through this peer. Notice that PostUp opens FORWARD for the wg0 interface, because a gateway does not only accept packets addressed to itself.

#wg0.conf at Office B

[Interface]
Address = 10.9.0.2/30
ListenPort = 51820
PrivateKey = <kunci privat B>
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT
 
[Peer]
PublicKey = <kunci publik A>
AllowedIPs = 10.1.0.0/24, 10.9.0.1/32
Endpoint = 203.0.113.1:51820

Notice that AllowedIPs on each side declares the network subnets of the opposite site, not just the tunnel address. This is what routes the devices behind the gateway through the tunnel.

#Routing and Firewall

#Forwarding on Both Gateways

The WireGuard gateway must forward packets between interfaces. Enable kernel forwarding and remember to persist it:

sudo sysctl -w net.ipv4.ip_forward=1
echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-wg-forward.conf

#Firewall Rules Between Sites

In addition to FORWARD from wg0, make sure the firewall accepts incoming packets from the LAN interface and forwards them into the tunnel. Use nftables for a clear policy:

table inet wg {
    chain forward {
        type filter hook forward priority 0; policy drop;
        iifname "wg0" accept
        oifname "wg0" accept
    }
}

The iifname "wg0" accept and oifname "wg0" accept rules above accept packets entering and leaving through wg0, while other traffic is still dropped. Save the policy with nft -f file.conf and load it at boot.

#Verifying the Inter-Site Connection

After both gateways are up, test from office A:

ping -c 3 10.9.0.2
ping -c 3 10.2.0.10
sudo wg show wg0

The first ping tests the tunnel; the second tests forwarding to a real device on LAN B. If the ping to 10.9.0.2 succeeds but the one to 10.2.0.10 fails, check the FORWARD rules on gateway B.

#Closing

Episode 9 completed the site-to-site VPN: choosing a topology, configuring two WireGuard gateways with AllowedIPs holding the opposite LAN's subnets, enabling forwarding, and setting up firewall rules that forward traffic between sites.

Key takeaways:

• In site-to-site, AllowedIPs holds the opposite LAN's subnets, not just the tunnel address.
• Full mesh suits two sites; hub-and-spoke suits many sites.
• Both gateways must enable net.ipv4.ip_forward=1.
• FORWARD rules are required so packets can be forwarded through wg0.
• Use nftables with a drop policy and allow wg0 explicitly.

In episode 10 we cover client-to-site remote access — connecting laptops and mobile devices to the office network, distinguishing split tunnel and full tunnel, managing keys per client, and introducing management tools such as wg-dashboard and Firezone.