Connect two subnets use overlay network(VPN) reddit / selfhosted ---------------------------------------------------------------------- RMTTT · 2023-12-04 13:02 I'm seeking a overlay network solution to satisfy following requirements: https://preview.redd.it/02efc5jsz94c1.png?width=973&format=png&auto=we bp&s=083a73abdb3508a787a2ef0fdb55e9b28ce25b4e I have a vps which have public ip as master node to connect two subnets, i want: 1. subnet 1 and subnet 2 can connect to each other 2. visit node in same subnet will try nat traversal; for example, visit B from A will try nat traversal firstly, if cannot punching, then use relay mode via master. 3. visit node in different subnets only use relay mode; for example, visit C from A will only use relay mode via master. ​ I tried plain wireguard but it cannot satisfy my requirements, but i prefer to use wg-based overlay network tool. ​ Appreciate for any suggestions! ---------------------------------------------------------------------- wideace99 · 2023-12-04 14:08 Please correct me if wrong, you want: 1. subnet 1 and subnet 2 routeing over master 2. Node B connect directly to Node A since they are in the same subnet 3. Node C to connect to Node A over master which is the same thing as no.1 ? ---------------------------------------------------------------------- cdemi · 2023-12-04 14:12 > visit node in same subnet will try nat traversal If they're on the same subnet why would you need to do NAT Traversal? > I tried plain wireguard but it cannot satisfy my requirements Why not? It sounds like wireguard configured with static routes on the routers/firewalls for subnet 1 and subnet 2 is all you need. I don't even see the need for "master" VPS, unless both routers at subnet 1 and subnet 2 can't do port forwarding (for example CGNAT). In which case, you can use master or try STUN with something like Tailscale ---------------------------------------------------------------------- RMTTT · 2023-12-04 14:27 \> If they're on the same subnet why would you need to do NAT Traversal? The subnet is the virtual subnet, not the physical. ---------------------------------------------------------------------- RMTTT · 2023-12-04 14:30 sorry, i forget mention that the subnet 1 and subnet 2 are virtual networks, not the physical subnet, so node A and B cannot connect directly. ---------------------------------------------------------------------- RMTTT · 2023-12-04 14:32 sorry, i forget mentioned that subnet 1 and subnet 2 are virtual networks, not the physical subnet, so A and B cannot directly connect. 1 and 3 is correct. ---------------------------------------------------------------------- cdemi · 2023-12-04 14:36 So looks like you need full-mesh in Subnet 1 and full-mesh in subnet 2, with static routes on "master". Should be easily doable in Wireguard ---------------------------------------------------------------------- RMTTT · 2023-12-04 14:48 yeah, but implement full-mesh in wireguard is cumbersome for configuration. hmmm, seems i know how to do it, thanks. ---------------------------------------------------------------------- cdemi · 2023-12-04 15:05 That's true. I haven't used any wireguard UIs so that's the most I can help with ---------------------------------------------------------------------- DaFyre2010 · 2023-12-04 15:35 Are Subnet 1 and Subnet 2 both located on the SAME VPS server or different ones? ---------------------------------------------------------------------- wideace99 · 2023-12-04 16:02 How about to re-draw and also to add every subnet/netmask, IP's and the rest of the missing data ? You can change the real IP's for privacy purpose, just keep a separation between private and public IP's. ---------------------------------------------------------------------- RMTTT · 2023-12-05 04:25 same vps ---------------------------------------------------------------------- RMTTT · 2023-12-05 04:37 Have updated. ---------------------------------------------------------------------- DaFyre2010 · 2023-12-05 04:40 If they're on the actual same server, no VPN is needed, right? You can enable IP\_FORWARD on Master ([https://linuxconfig.org/how-to- turn-on-off-ip-forwarding-in-linux](https://linuxconfig.org/how-to- turn-on-off-ip-forwarding-in-linux) Assume Subnet 1 = 192.168.50.0/24, Master = 192.168.50.1, HostA=192.168.50.12 Assume Subnet 2 = 192.168.75.0/24 Master = 192.168.75.1 HostC=192.168.75.25 For hosts on Subnet 1, you would `ip route add` [`192.168.75.0/24`](https://192.168.75.0/24) `via` [`192.168.75.1`](https://192.168.75.1) For hosts on Subnet 2, you would `ip route add` [`192.158.50.0/24`](https://192.158.50.0/24) `via` [`192.168.50.1`](https://192.168.50.1) My syntax may be off a bit, but that's the general idea. If VPN is needed, that complicates things a little, but not much. ---------------------------------------------------------------------- wideace99 · 2023-12-05 06:15 Old "master" has changed now in TURN without any technical info... what a mystery :) It's the job of the VPN to provide routing between its clients, else it's in the best case just a VP (without N for network). So clients in the same subnet should connect to each other without problems... else check your VPN settings. The middle server already have routes for the 2 separate VPN subnets all it need is to activate IP routing presuming there is no firewall and should work routing between subnets. Also, the middle server it's a router in this case... not a TURN server. Presuming that TURN = Traversal Using Relays around NAT you don't need that to route between subnets just use a router. ---------------------------------------------------------------------- kmisterk · 2023-12-05 17:12 ## Post Removed Hey, RMTTT! Thanks for your submission on selfhosted. Your post has been removed due to a violation of the purpose of the subreddit: **Self Hosting** ## Not Self-Hosted When it comes to posts regarding applications in this subreddit, they must feature a self-hosted tool, or a tool that *can be* self-hosted, or some kind of related information, help request, or otherwise related to a tool that is something that one can self-host. If you believe this post *is in fact* relevant to /r/selfhosted, feel free to [message the mods](https://www.reddit.com/message/compose/?to= /r/selfhosted&subject=Removed For Not Being Self- Hosted&message=[Removed Post](https://www.reddit.com/r/selfhosted/comments/18ajqkg/-/\)) with your concerns.