[lenox82]

Hi!
I would like to ask for help in configuring Wireguard on my router (Asus rt-n66U f:v3.0-r55179 big).
I've read the configuration guides but it still doesn't work the way I want it to.
I need to configure DD-WRT as a WG client (non-public IP address).
The main WG server is a VPS that has a public IP address. I want to connect two WG clients to it (mikrotik and DD-WRT) that do not have public IP addresses. While Mikrotik seems to work properly, I have a problem with DD-WRT.
I want the mikrotik local networks (e.g. 192.168.1.0/24) and DD-WRT (e.g. 192.168.2.0/24) to see each other. I want every IP address from one network to see every address from the other network as well as the main server.
The WG server (VPS) has an address e.g. 10.10.10.1, Mikrotik e.g. address 10.10.10.2 and DD-WRT address 10.10.10.3.
And while I can ping the DD-WRT address 10.10.10.3 from the server and Mikrotik, I cannot ping the 10.10.10.3 address from the DD-WRT local network.
I don't know if I should enable DD-WRT:
1. NAT via Tunnel
2. Firewall Inbound (SPI firewall is enabled)
3. Advance Settings - should I turn it on and set some PBR?
4. Peer (VPS server) has endpoint enabled and correct IP address.
5. What IP to set in Allowed IPs (peer)
6. Route Allowed IPs via Tunnel (peer) is enabled
7. Persistent Keepalive - is it necessary?
8. IP Addresses / Netmask (CIDR) are set to 10.10.10.3/32 - there was a problem with the /24 mask

I want the main traffic from the DD-WRT local network to go normally through the router and only the addresses:
- 192.168.1.0 (mikrotik)
- 10.10.10.2 (WG mikrotik) and 10.10.10.1 (VPS)
- domain, e.g. server.loc and nas.loc - target addresses in the mikrotik local network.
were sent by WG.

[egc]

WireGuard Advanced setup guide see multi router setup: Hub and spoke setup
The routers are basically setup as a server with allowed ips as the subnets of the other participants and the wg subnet

[kernel-panic69]

@egc: I edited your post to add direct link because people don't always make connection to the stickies or announcements.

[egc]

Thanks

[lenox82]

[egc]

On your vps there is overlap of the peers.
You should set the peers addres with /32 e.g. 10.10.10.3/32.

Furthermore on the vps you should allow all traffic coming in on wg0 not only going out of ens6.
Because traffic between the peers comes in on wg0 but also goes out of wg0.

For DDWRT better use for MTU 1420.