Multiple Physical Interfaces

[xshadowtrooperx]

I am running this on a virtual machine that has access to 2 physical ethernet ports. I want to use one ethernet port for encrypted traffic to the internet and the other to connect clients to local LAN resources.

Right now it seems like it is trying to route all traffic through a single interface which halves available bandwidth.

How might I go about configuring such a setup?

[eduardogsilva]

Hello @xshadowtrooperx !

The traffic will exit from the docker network, to the docker host. From there, the traffic will follow the host traffic routing table. So if your host is already redirecting the traffic through multiple network interfaces, the traffic will follow the same route.

Unless you have some firewall rules dropping or rejecting the traffic to your local network, or you have some peer configured networks conflicting with your LAN, there's actually nothing to change on your wireguard_webadmin.

Cheers!

[xshadowtrooperx]

Ok, I'll play around with that and see what I can come up with. Thanks!

[eduardogsilva]

If you need any advice, feel free ask here.

Cheers!

[xshadowtrooperx]

After playing with the routes I was able to enable the desired behavior. One more thing. Say I had a client connect, and I wanted to be able to send traffic to the client from the virtual machine.

I can ping the "gateway" of the VPN's subnet from the host virtual machine but not the actual device.
I can ping the device from within the docker container by using docker exec however.
How would I go about doing this?

[eduardogsilva]

I'm not quite sure if I understood exactly what you are trying to do.

As far as I could understand, you are trying to route traffic from "outside docker" (or the host vm) to a peer that is connected to the vpn. is that correct?

In this case, I believe that you will not be able to route traffic direct from the host to the container. I don't think that docker will allow this transparently. Also... whenever you restart the container, it can receive a new ip address breaking your routes. Even if you figure this out, I'm not sure if docker would allow routing traffic to the containers.

The easiest way to achieve this, would be connecting the main host to the vpn as a peer and add the routes using the vpn.
If you do this, you really need to configure the main host's wireguard client to not use the VPN as the default gateway (0.0.0.0/0). You should only route the internal networks that you want to reach from the outside.

Take a look on the screenshot below, you could add a peer and just set the routes that you need on the "Client Routing Configuration"

The client config file, will be generated without the default route.

Cheers

[xshadowtrooperx]

Yes, that's correct. I will give it a go, and set the "Allowed IPs" field to only the vpn devices' subnets.

Thanks a lot for your help, and for this application. It's outstanding.