Manual

Example: two locations with a tunnel

Connecting two locations, with addresses that do not get in each other's way.

Two places that need to reach each other: a head office and a second branch, or an office and someone working from home. The board has locations and tunnels for this, so you draw it instead of working it out.

First: do not let the networks clash

The biggest mistake is made before anything is configured. If both locations sit on 192.168.88.0/24, you can connect them all you like, but no device knows which way to go. Give each location its own range, for example:

  • Head office: 10.1.x.x
  • Second location: 10.2.x.x

On the board

  1. Place your devices and run the cables per location.
  2. Click + Location and draw an area around the devices of the second place. Give it a name and its own address range: that is the first two numbers, so 10.2. Everything you drag into it belongs to it and takes its addresses from that range. Drag the location's label and the whole contents move with it; the bottom-right corner resizes the area.
  3. Connect the two routers with a tunnel. Right-click a router, choose Tunnel to, pick the type and press Create.

Which tunnel

  • WireGuard — the default choice. Encrypted, fast, works behind NAT, few settings. One side needs a reachable address or a hostname. The key pairs are made in your browser and stay there.
  • GRE or IPIP — simple routing between two fixed addresses. These two really need an IP address on the other end, not a DNS name. An IPsec secret is filled in straight away; clear it and the tool warns you that the tunnel is unencrypted.
  • EoIP or VXLAN — the same layer 2 network in two places. The tunnel goes into the bridge of both routers, and you choose which VLANs travel over it. Sometimes necessary, but remember you then share all the broadcasts and all the problems too. Watch the MTU here, because these tunnels carry whole Ethernet frames.

For routers on a dynamic address from their ISP: give the side that dials out a hostname through DDNS, or let the side with the fixed address listen.

What you fill in on the tunnel

The tunnel panel holds, per router, the public address (IP or DNS name), the transfer network as a /30 (the tool takes the next free one from 10.255.255.0), the WireGuard port (13231 by default), and whether routes to the other location should be added. A layer 2 tunnel also has a tunnel id or VNI and the choice of which VLANs may cross it. To use BGP instead of static routes, switch it on and give both routers an AS number; a TCP MD5 password is recommended.

What you end up with

  • The tunnel on both routers as an interface of its own, with an address from that small transfer network.
  • On WireGuard, a peer with the other side's key, the other side's address as its allowed address and that location's networks alongside, with a keepalive of 25 seconds.
  • Routes so the network on the other side is reachable through the tunnel, or a BGP session if that is what you chose.
  • Firewall rules that allow the tunnel traffic without opening up the rest. On a tunnel with IPsec, rules allowing IKE and ESP from that one address are added too.

The Traffic button on the board shows whether a system at one location may reach the other side, and which stage stops it: the route, the firewall, WireGuard or the way back.

What the checks report

  • No public address. If neither router has one, WireGuard does not know where to go; with GRE or IPIP the far end has to be an IP address rather than a name.
  • A routed tunnel on a device that does not route. It achieves nothing there.
  • Overlapping networks. If both sides use the same subnet, the routes over the tunnel clash. Two locations sitting on the same subnets are reported as well: you could not join them over a VPN later.
  • Locations without a router, or with two of them, and two locations using the same address range.
  • BGP without an AS number, and missing WireGuard keys.

What else to watch

  • MTU. Less than 1500 bytes fits through a tunnel. WireGuard uses 1420 by default, which fits on an ordinary connection. On PPPoE with peers connecting over IPv6, 1412 is the safe value. See MTU and jumbo frames.
  • DNS. Names from the other location do not work by themselves. Have your router forward the other side's names, or use addresses.
  • Firewall on both ends. A tunnel is only usable when both sides allow the traffic; opening one side is enough to spend an hour searching.
  • A script per device. You get one per router, and they belong together: paste both, or the tunnel only exists on one side.

Further reading: Tunnels between locations and The network board.

Want to try it right away? Open the configurator