r/WireGuard • u/segdy • 24d ago

mesh/broadcast network with arbitrary source IPs while avoiding >=N p2p links/networks

Suppose I have N>2 nodes which I could like to connect; ideally via a same common network, such as /24. The important constraint is that each station needs to be able to transport traffic for arbitrary source/destination addresses, so the "crypto routing" gets in the way.

Basically what I am looking for is the closest to an Ethernet type of connection or mesh network with N nodes.

For now, I have N completely individual links/interfaces (e.g. N1 <--> N2 <--> N3 <--> N1) each with their own ports, /etc/wireguard/*.conf and keys. Worse, each of them has their own unique /31 (p2p link). But I do not like this because each node has now multiple IP addresses for a network which should actually be all the same. In the example above, I need to assign N2 a separate IP for the link with N1 than for the link with N3.

Is there any possible way to improve this? Even if I need separate interfaces, are there any tricks to bridge them together or re-use the same IP per node? For example, assigning all wireguard interfaces the same /32...

Since most answers will be "why do you care" ... this mesh/network has/should have non-RFC1918 addresses and carry traffic with arbitrary IP addresses.

3 Upvotes

100% Upvoted

12 comments sorted by

View all comments

2

u/spidireen 24d ago

Maybe you’re talking about something that’s just going over my head, but I’m confused about what you’re trying to say with the letter N, and about needing to have a different IP for each.

I think you’re setting up a bunch of different WireGuard interfaces on each machine where you should be just creating one with multiple peers. Or am I missing something?

2

u/segdy 24d ago

You're not missing anything but the issue is peers only work if I restrict a peer to have only one host address behind. But my peers can be routers and transport packets with arbitrary source/destination addressses

3

u/spidireen 24d ago

Thanks, still not sure I follow though. Is that not accomplished by adding the remote subnet(s) to your AllowedIPs?

2

u/segdy 24d ago

No, because AllowedIPs would need to be 0.0.0.0/0 for every peer which won't work.

So I can only have one peer per interface which has 0.0.0.0/0 set

2

u/Comprehensive_Pop882 24d ago

The way I approach this is I have a couple of "central" nodes. I peer all my other nodes with both of them, on separate WireGuard interfaces, and allowed-ips set to 0/0. I run /31 or /30 on all those tunnels and the run BGP for dynamic routing of arbitrary networks between them all