[How-To] Stand Up WireGuard P2P between two sites

Overview of the Setup

• JAX01 (Your Homelab):

  • Network: Multiple VLANs.
  • VPN VM: Will be connected to a dedicated VLAN for VPN traffic.
  • Local Networks: Accessible alongside the VPN.

• JAX02 (Friend’s Homelab):

  • Network: Single non-VLAN network (192.168.60.0/22).
  • VPN VM: Connected to the main network.
  • Local Networks: Accessible alongside the VPN.

• Objective:

  • JAX01: Access both local VLANs and JAX02’s network without disrupting local internet traffic.
  • JAX02: Access both local network and JAX01’s network without disrupting local internet traffic.
  • Avoid DHCP Conflicts: Ensure that DHCP servers on both sides do not interfere with each other.

---

Prerequisites

1. Ubuntu 24.04 Server VMs:

   • JAX01SITE01 VM: Connected to a dedicatedlocal VLAN for VPN traffic.network.
   • JAX02SITE02 VM: Connected to thea main 192.168.60.0/22local network.

2. Static IP Addresses:

   • Ensure both VPN VMs have static IPs within their respective networks to maintain consistent VPN connectivity.

3. Firewall Access:

   • Ensure that UDP port 51820 (default WireGuard port) is open on both networks' firewalls to allow VPN traffic.

4. Access to Network Equipment:

   • Ability to create and manage VLANsnetworks onat JAX01’sboth network infrastructure.sites.

---

Step-by-Step Installation and Configuration

1. Install WireGuard on Both Servers

On Both JAX01SITE01 and JAX02SITE02 VPN VMs:

1. Update Package Lists:

   bash

   Copy code

   sudo apt update

2. Install WireGuard:

   bash

   Copy code

   sudo apt install wireguard -y

2. Generate WireGuard Keys

On Both Servers:

1. Generate Private and Public Keys:

   bash

   Copy code

   umask 077 wg genkey | tee privatekey | wg pubkey > publickey
   • Files Created:
     • privatekey: Keep this secure; never share.
     • publickey: Share this with your peer.

2. Exchange Public Keys:

   • JAX01'SITE01's VPN VM Public Key: Send to JAX02’SITE02’s VPN VM.
   • JAX02'SITE02's VPN VM Public Key: Send to JAX01’SITE01’s VPN VM.

3. Configure Network Interfaces

JAX01 (Your Homelab):

1. Create a Dedicated VLAN for VPN Traffic:

   • Assumption: Your primary network interface is eth0.
   • VLAN ID: Choose an unused VLAN ID, e.g., 10.

2. Configure the VLAN Interface:

   Edit the Netplan configuration:

   bash

   Copy code

   sudo nano /etc/netplan/01-netcfg.yaml

   Add the VLAN configuration:

   yaml

   Copy code

   network: version: 2 ethernets: eth0: dhcp4: no vlans: eth0.10: id: 10 link: eth0 addresses: - 10.10.10.1/24 # Example IP for JAX01's VPN interface

3. Apply Netplan Configuration:

   bash

   Copy code

   sudo netplan apply
   • Note: Ensure 10.10.10.0/24 is not overlapping with any existing networks.

JAX02 (Friend’s Homelab):

1. Ensure VPN VM is on the Main Network (192.168.60.0/22):
   • Assign a static IP, e.g., 192.168.60.10.

---

4. Configure WireGuard on Both Servers

JAX01SITE01 VPN VM Configuration:

1. Create WireGuard Configuration File:

   bash

   Copy code

   
   

   sudo nano /etc/wireguard/wg0.conf

2. Add the Following Configuration:

   ini

   
   

   Copy code

   [Interface]
   PrivateKey = <JAX01_PrivateKey>
   Address = 10.10.10.1/6.0.5/24
   ListenPort = 51820
   SaveConfig = true
   
   [Peer]
   PublicKey = <JAX02_PublicKey>
   AllowedIPs = 192.168.168.60.0/22,0/22, 10.10.10.2/6.0.10/32
   Endpoint = <JAX02_Public_IP>:51820
   PersistentKeepalive = 25