Post #2741389

@arichtman@eigenmagic.net aye, you can absolutely do that, but: There is no reason to limit the AllowedIPs to just a /64The wg interfaces don't need to be numbered from within any individual site's ULA /48 You kind of see this in the v4 equivalent guidance in those OPNSense docs: You will connect Site A LAN Net 172.16.0.0/24 to Site B LAN Net 192.168.0.0/24 using the Wireguard Transfer Net 10.2.2.0/24. The "Wireguard transfer net" is a fully discrete and separate network from the site A and B networks. If you have sites A and B, and you want to connect them through wireguard: Generate a /48 ULA for site AGenerate a separate /48 ULA for site BGenerate a separate /48 ULA again for wireguardPick a /64 from the wg ULA /48 to use for the wireguard overlay network, and number the wireguard interfaces at both sites A and B from that. This is the "wireguard transfer network". At site A's eg config when configured the site B peer, add site B's wg interface address to the peer AllowedIPs and also add the full site B /48 ULA to AllowedIPs as wellAt site B's wg config, do the inverse They may mention "just add the /64," but there is nothing preventing you from adding the full /48. You would then still control access to a given site using the firewall config at that site, for what is permitted in across the wg interface.