Hi @mgru 

Thanks for posting in our business forum.

Modify the Allowed-IPs. Understand why it is important. It is basically the core of the WG VPN.

Configuration Guide How to Configure WireGuard VPN on Omada Controller

Hi @mgru 

Thanks for posting in our business forum.

Can you set it to two subnets? 192.168.0.0/24 and 192.168.3.0/24

192.168.0.0/16 is not technically correct. I am not sure if this affects it or not. But it is not right.

Hi @mgru 

Thanks for posting in our business forum.

mgru wrote

  @Clive_A 

 

Hello, thanks for answer.

 

1) 

If set 192.168.1.0/24, then i can  connect to network 192.168.1.x, but not 192.168.3.x.
If set 192.168.3.0/24, then i can't connect to both. 

 

 

I found similar cases described on Reddit with both (WireGuard and Ipsec) on ER605, and other individuals had the same issue. No responses to the posts.

 

 

Of course, you cannot access it when you put 192.168.1.0/24. Nah. This is not a bug.

Google how subnet works and subnet calculator It is really the basic knowledge when you tweak the subnets.

I pointed out that you were setting the wrong subnets because the C class subnet did not work that way.

And based on what you said here if 192.168.1.0/24 works for anything in 192.168.1.0/24, then it is correct and WG is working.

But if you say that you set this 192.168.3.0/24? And you are certain you did not make a mistake in your sentence. I gotta ask a big WHY. (I read again what you original post and I don't see the point in putting 192.168.3.1/24 in allowed-ips.

Read the WG configuration guide on the forum. We are not on the same page in these concepts: what WG Allowed-IPs mean and how subnet works.

Please take some time to digest.

mgru wrote

  @Clive_A

 

2) by the way, I don't see any tunnels in the network interfaces. Not in the routing tables either. Is it possible to additionally direct some traffic through the tunnel by adding static routing?

 

I found that people asked a similar question in 2019/2020 for Archer C6 and they also did not get an answer (https://community.tp-link.com/en/home/forum/topic/173622). Maybe omada works in a similar way?

 

Network Interface? What do you mean by this specifically? Is this a term in our device? Or you refer to the Routing Table?

VPN routings are not listed in the Routing Table. Not just applied to the WG VPN. This was explained once before when I answered someone else on the forum. Unlike WindowsOS where you see all the existing routing entries.

No.

mgru wrote

  @Clive_A 

 

 

3) ping/traceroute from "system tools / diagnostics" does not work properly for tunneled traffic. I ping addresses that are definitely working and I can communicate with them - and there is no ICMP response in the tools.

 

If you don't pick the right interface or if it does not list the VPN tunnel, it does not make sense to use it. I recall that the VPN tunnel is not listed/supported.

Hi @mgru 

Thanks for posting in our business forum.

mgru wrote

  @Clive_A 

 

In the first email, I provided the addresses: 192.168.0.1/24 and 192.168.1.1/24. There was a request for screenshots, but I don't have remote access to that client, so I sent screenshots from another client where the scenario is identical, but the addressing is 192.168.1.1/24 and 192.168.3.1/24. I mentioned this at the end of post #4.

Anyway, it works. And I gave the replication of what you need to do above. With a screenshot of the verification.

It would be great if you could give a diagram if you cannot describe it clearly. If it is 192.168.0.1 and 192.168.1.1, the IPsec was wrong in your screenshot. Subnet is 192.168.1.1 and 192.168.3.1. I see no 192.168.0.1. It does not match and shows inconsistency.