need basic help #245
Replies: 3 comments 5 replies
-
|
Howdy, Yeah that documentation saying site to site is just not correct. I cant remember why I wrote that. Can you give your acls config? Wag has an in-built firewall that lets you define what resources can hit what routes and it sounds like the rule isnt being hit. |
Beta Was this translation helpful? Give feedback.
-
|
Hi NHAS, thank you for your super fast response. Switching NAT to "false" seems to be the solution. Ping is working now and I proceed with the learning by doing thing.....(Hope net behind the client will work without NAT) |
Beta Was this translation helpful? Give feedback.
-
|
Hi NHAS, |
Beta Was this translation helpful? Give feedback.






Uh oh!
There was an error while loading. Please reload this page.
-
Hello,
when I read the docs and the discussions, wag seems to be what I'm looking for. Although there are some contradictions in the docs. E.g: in limitations I read: "Only supports clients with one AllowedIP, which is perfect for site to site, or client -> server based architecture". On the other hand routing or routing restrictions seem to be a main function in wag. How can routing work when a Client has only one allowed IP?
On the learning by doing way I got stuck on an early stage: Wag is running as a docker container on a Cloud Server. I could - after a while - configure some clients which are now busy hand shaking with the server. From every client I can successfully ping the (wag-)server (10.168.168.1) but not from client to client let alone a machine behind a client.
Every client config has the wag-net (10.168.168.0/24) as "allowed IPs" and under wag rules every user has this network as public rule.
Tcp-dump on the docker host shows incoming packets which seem to correspond with then client ping reqests but there seem to go no packets out to the target client.
In a classic wireguard installation I would dump the packets in the server for analysis. The Basic red-hat machine behind wag gives no such tools and so I have no idea what I'm doing wrong or what I misunderstand.
Can anybody help me?
My goal is to manage access for several road warriors to machines behind client gateways. Is this possible at all (see restrictions)?
Beta Was this translation helpful? Give feedback.
All reactions