Post #2741379

@arichtman@eigenmagic.net @futzle@old.mermaid.town I'm...a bit confused. I'm not using GUAs at all in the VPN config but I wanted to split tunnel my v6 delegated prefix over the LAN so I don't have to open the firewall. So... You want to access services on machine 2, at site B, from machines in site A. But you want to do that without punching holes in the firewall at site B. So you want to use wireguard to route privately from site A to site B. Yes? If so: If you have stable GUAs, then sure, you can chuck them in the wireguard config and then access site B resources from site A without punching holes in the firewall at site B to the public Internet. But, if you want stable addresses then we'll need either ULAs or something like acquired GUAs that get NPTv6 at edge (more complicated, imho; just adding for completeness). I don't believe wg would support dynamically injecting AllowedIPs based on DNS entries. You could try to do this yourself, but the problem is that AllowedIPs is configured on the "far" end, so you'd need to orchestrate or coordinate this. IOW if the GUA prefix at site B changes, you have to update the site B peer config at the site A router. What you could do is skip Wireguard crypto key routing and use a routing protocol instead, with 0/0 and ::/0 AllowedIPs in the peer config and Table = off. That has more moving parts (and things get more weird if you go point to multipoint with routing protocols over wireguard), but for a 2-site setup that could allow you to route to GUAs that are not stable, using DDNS to drive the traffic to the GUA addresses of site B and routing protocols across a ::/0 AllowedIPs peer config.