How to Configure Site-to-Site WireGuard VPN on Omada Controller
23062 Application Scenario
Configuration Overview:
1. Configure the HQ Site WireGuard Interface
2. Configure the Satellite Site WireGuard Interface
3. Configure Peer Information on the HQ Site Controller
4. Configure Peer Information on the Satellite Site Controller
5. Verification
Configuration Steps:
Configuring the HQ Site WireGuard Interface:
1. Launch the Omada SDN Controller and select a site from the Organization drop-down list. Go to Settings > VPN > WireGuard.
2. Click Create New WireGuard and configure the parameters.
- Name: Specify the name that identifies the WireGuard interface. (This does not affect the VPN tunnel or behavior.)
- Status: Specify whether to enable the WireGuard interface. (Enable or turn off your VPN tunnel.)
- MTU: Specify the MTU value of the WireGuard interface. The default value of 1420 is recommended. (Usually, it does not need to be set and is generally determined automatically by the system.)
- Listen Port: Specify the port number that the WireGuard interface listens to. The default value is 51820.
Note: Usually, the client does not need this to be configured. In this example, our router is the server. You can change this if required and if you are familiar with making these changes.
- Local IP Address: Specify the IP address of the WireGuard interface. (Define the IP address of the WireGuard interface, which should be a non-occupied IP address. It is okay to configure outside your existing LAN range.)
- Private Key: Specify the private key of the WireGuard interface. The value will be automatically generated on the device, and you can modify it manually (Defines the private key of this specific VPN tunnel. It must be set and cannot be shared with other tunnels.)
3. Click Apply. The WireGuard VPN entry will be displayed.
Step 2. Configure the Satellite Site WireGuard Interface:
1. Launch the Omada SDN Controller and select a site from the Organization drop-down list. Go to Settings > VPN > WireGuard.
2. Click Create New WireGuard and configure the parameters.
- Name: Specify the name that identifies the WireGuard interface. (This does not affect the VPN tunnel or behavior.)
- Status: Specify whether to enable the WireGuard interface. (Enable or turn off your VPN tunnel.)
- MTU: Specify the MTU value of the WireGuard interface. The default value of 1420 is recommended. (Usually, it does not need to be set and is generally determined automatically by the system.)
- Listen Port: Specify the port number that the WireGuard interface listens to. The default value is 51820. (Usually, the client does not need this to be configured. In this example, our router is the server. You can change this if needed and know what you are doing.)
- Local IP Address: Specify the IP address of the WireGuard interface. (Define the IP address of the WireGuard interface, which should be a non-occupied IP address. It is okay to configure outside your existing LAN range.)
- Private Key: Specify the private key of the WireGuard interface. The value will be automatically generated on the device, and you can modify it manually (Defines the private key of this specific VPN tunnel. It has to be set and cannot be shared with other tunnels.)
3. Click Apply. The WireGuard VPN entry will be displayed.
Step 3. Configure Peer Information on the HQ Site Controller:
1. Launch the Omada SDN Controller and select a site from the Organization drop-down list. Go to Settings > VPN > WireGuard > Peers.
2. Click Create New Peer. Configure the parameters and click Apply.
- Name: Specify the name that identifies the WireGuard tunnel.
- Status: Specify whether to enable the peer setting.
- Interface: Choose the WireGuard interface to which the peer belongs.
- Endpoint: Specify the IP address of the peer. This parameter is required when the Omada Router connects to other WireGuard peers. (If you need to specify the peer server, you can put the public IP address of the peer server. If the HQ has initiated the connection, this can be optional, as in this guide. If you don't specify the Endpoint on both sites, the connection cannot be made.)
- Endpoint Port: Specify the port number of the peer. This parameter is required when the Omada Router connects to other WireGuard peers.
- Allowed Address: Specify the address segment that allows traffic to pass through. (Here, you should specify the subnet of the peer LAN. This defines what you are allowed to access on the peer site. You won’t have access to the subnet if you don't include it.)
- Persistent Keepalive: Specify the tunnel keepalive packet interval. (This defines the interval of the keepalive packet sent to the Allowed Address.)
- Comment: Enter the description of the peer.
- Public Key: Fill in the public key of the peer Satellite site.
- Preshared Key: Specify a shared key if needed.
Step 4. Configure Peer Information on the Satellite Site Controller:
1. Launch the Omada SDN Controller and select a site from the Organization drop-down list. Go to Settings > VPN > WireGuard > Peers.
2. Click Create New Peer. Configure the parameters and click Apply.
- Name: Specify the name that identifies the WireGuard tunnel.
- Status: Specify whether to enable the peer setting.
- Interface: Choose the WireGuard interface to which the peer belongs.
- Endpoint: Specify the IP address of the peer. This parameter is required when the Omada Router connects to other WireGuard peers. (If you need to specify the peer server, you can put the public IP address of the peer server. If the HQ has initiated the connection, this can be optional, as in this guide. If you don't specify the Endpoint on both sites, the connection cannot be made.)
- Endpoint Port: Specify the port number of the peer. This parameter is required when the Omada Router connects to other WireGuard peers.
- Allowed Address: Specify the address segment that allows traffic to pass through. (Here, you should specify the subnet of the peer LAN. This defines what you are allowed to access on the peer site. You don't have access to the subnet if you don't include it.)
- Persistent Keepalive: Specify the tunnel keepalive packet interval. (This defines the interval of the keepalive packet sent to the Allowed Address.)
- Comment: Enter the description of the peer.
- Public Key: Fill in the public key of the peer HQ site.
- Preshared Key: Specify a shared key if needed.
Verification:
1. Verify that the HQ site has access to the Satellite site.
Use a computer from the HQ to ping the Satellite gateway and PC.
Use a computer from the HQ to access the file server located on the Satellite site. Files can be uploaded or downloaded without any problems.
2. Verify that the Satellite site has access to the HQ site.
Use a computer from the Satellite site to ping the HQ gateway.
Is this faq useful?
Your feedback helps improve this site.
1.0_01_normal_20231207030929b.png)
TP-Link Community
Still need help? Search for answers, ask questions, and get help from TP-Link experts and other users around the world.