HowTo: WireGuard site-to-site — two networks connected

A site-to-site tunnel links two LANs (two offices) through an encrypted channel, as if they were on the same network. Setup on both gateways, step by step.

1. Keys + IP forwarding

# pe FIECARE gateway (site A si site B): chei
cd /etc/wireguard; umask 077
wg genkey | tee priv.key | wg pubkey | tee pub.key
sudo sysctl -w net.ipv4.ip_forward=1

2. Site A config

# SITE A (LAN 192.168.10.0/24) — /etc/wireguard/wg0.conf
[Interface]
Address = 10.0.0.1/30
ListenPort = 51820
PrivateKey = <priv.key SITE A>

[Peer]
PublicKey = <pub.key SITE B>
Endpoint = SITE_B_PUBLIC_IP:51820
AllowedIPs = 10.0.0.2/32, 192.168.20.0/24   # LAN-ul site B
PersistentKeepalive = 25

3. Site B config

# SITE B (LAN 192.168.20.0/24) — /etc/wireguard/wg0.conf
[Interface]
Address = 10.0.0.2/30
ListenPort = 51820
PrivateKey = <priv.key SITE B>

[Peer]
PublicKey = <pub.key SITE A>
Endpoint = SITE_A_PUBLIC_IP:51820
AllowedIPs = 10.0.0.1/32, 192.168.10.0/24   # LAN-ul site A
PersistentKeepalive = 25

4. Firewall + start

# pe ambele: firewall + pornire
sudo ufw allow 51820/udp
sudo systemctl enable --now wg-quick@wg0
sudo wg show

5. Verify

# de pe un host din LAN-ul A, catre un host din LAN-ul B
ping 192.168.20.10
sudo wg show    # 'latest handshake' + transfer > 0 = tunel activ

Conclusion

You now have two offices securely connected, with routing between LANs. We extend it with more sites (hub-and-spoke) or failover on request.