A head office with five branches

With two locations you lay a tunnel. With six you have to choose: everyone to everyone is fifteen tunnels, everyone to the head office is five. That second shape is called hub and spoke, and for a company with a central server, central administration and branches that mostly talk inwards it is nearly always the right one.

The plan

The head office takes the lowest range and the branches count on from there. Give yourself room: start at 10.10 and leave 10.11 to 10.19 free for whatever comes next, instead of filling 10.1 to 10.6 straight away.

The VLAN numbers are 10, 20, 30 and 99 everywhere. Only the first two numbers differ, and you fill those in once per location.

In the tool

1. Make one site holding all six routers, plus the switches and access points that go with them.
2. Fill in the site's VLAN table once.
3. On the network board, draw six locations and give each one its own address range: 10.10, 10.21, and so on.
4. Set the public address on the head office router. The branches do not need one: they dial out, and the tool sets a keepalive of 25 seconds, so a branch behind CGNAT works fine.
5. Right-click the hub router and create Tunnel to five times, once per branch. The tool gives the hub wg1 to wg5 and every branch its own wg1.

Each tunnel takes the next free /30 out of 10.255.255.0: .0, .4, .8, and onwards. That range holds 64 tunnels, so you will not run into its edge in a network of this shape.

What "only to the hub" means

This is the part that surprises people. Per tunnel the tool works out which networks sit on the far side and writes them as routes and as the WireGuard peer's allowed address. The result:

• The hub knows the networks of all five branches and can reach all five.
• Each branch knows only the hub's networks.
• Branch 1 cannot reach branch 2. Not because a firewall rule stops it, but because WireGuard drops anything that is not in the allowed address, and nothing about branch 2 is in there.

For most companies that is what you want: a till in one town has no business on a network in another. If it does have to work, you do it by hand, and in three places at once:

• On each branch, widen the peer's allowed address, for example to 10.0.0.0/8 instead of only the hub's networks.
• On each branch, a route to that summary through wg1.
• On the hub, check that traffic between two tunnel interfaces is allowed through the forward chain. Check /ip route print and /interface wireguard peers print before you start hunting through the firewall.

The tool does not generate this. It knows two ends per tunnel and nothing about transit through a third router. If you want spoke to spoke, write those lines yourself and note them on the handover sheet, or in two years nobody will know why that one route is there.

What has to stay local

A branch has to keep working when the tunnel is down. That means its own DHCP, its own DNS resolver on its own router, its own internet connection. If the tills only work while the head office is reachable, you have not built a network with branches, you have built a network with five single points of failure.

What does belong centrally: the VLAN numbering, the SSIDs and their passphrase, the administrator password, the time zone and the management VLAN. All of that sits in the shared settings and reaches all six locations by itself.

What the checks catch

• Two locations on the same range. With six locations you mistype that sooner than you think.
• Overlapping networks across a tunnel. The tool names the network that appears on both sides.
• A location without a router, or with two of them.
• No public address on the hub, which breaks every tunnel at once.
• Two devices with the same name. With thirty devices this really happens; the identity has to be unique.

And at ten branches

Technically nothing changes: eleven routers, ten tunnels, the same pattern. What changes is the work around it.

• Static routes get tiresome. Every new branch means another tunnel on the hub and regenerating the hub's script. Somewhere between ten and twenty, OSPF between locations or BGP over the tunnels becomes the calmer option. The tool can switch BGP on per tunnel when both routers have an AS number.
• The board gets crowded. Spread the locations out and use short, systematic names; see Naming things.
• The rollout becomes repetition. That is a subject of its own: Rolling out twenty branches.
• The hub becomes important. Ten tunnels on one router that also serves the central servers is not a device you reboot on a Tuesday afternoon. Think about a spare, and read Two routers as one gateway.

Further reading: A numbering plan that survives growth, Tunnels between locations and Stretching layer 2 or routing.