Two offices, one design

Two offices with a router each is not the same thing as two networks. The moment a tunnel joins them it is one design with two halves, and the choices you make now decide whether you can add a third location later or have to renumber everything.

One VLAN plan, two address ranges

The rule that carries this whole chapter: tags are the same everywhere, addresses are different everywhere. VLAN 20 is the guest network at both places, but the subnets may never overlap, or no device knows which way to send a packet.

The third octet follows the VLAN number, the first two numbers are the location. That is exactly the model the tool uses, so you do not have to work it out twice.

Where this lives in the tool

Pick Multiple devices and put the devices of both offices in the same site. Not two separate configurations: one site, because only then do the checks run across the whole set and can the tool configure a tunnel on both ends at once.

Fill in the VLAN table once under VLANs of the site, with office A's addresses. Then go to the network board and draw two Locations: an area around A's devices and one around B's. Give the second location 10.2 under Own address range. Every VLAN keeps its third and fourth octet there, so 192.168.10.1/24 becomes 10.1.10.1/24 and 10.2.10.1/24 without you keeping a second table.

The first location you draw keeps the site's plan by default. If you want 10.1 written out there too, fill that range in yourself, or set the site addresses to 10.1.x.x from the start.

What is the same everywhere

• VLAN numbers and names. From the shared table, so a tag means the same network at both places.
• SSIDs, security and passphrase. From SSIDs of the site. Someone travelling from A to B connects without noticing.
• The administrator password and the time zone, through the shared settings.
• The management VLAN. 99 at both sites, so a switch in B is reached the same way as a switch in A.

What stays local

This is the part people skip, and the part the tunnel gets blamed for afterwards.

• DHCP. Each location has its own router handing out its own subnets. One DHCP server for both sides is a bad idea: if the tunnel drops, nobody on the far end gets an address. The tool puts the DHCP server for a VLAN on the router only, and only with that location's addresses.
• DNS. Each location's router resolves for its own clients. Names from the other side do not work by themselves: add a forward for them, or use addresses. See DNS.
• Printing and casting. mDNS and SSDP are broadcast and do not cross a routed tunnel. A printer in B belongs to B. To use it from A, add it by its fixed address.
• Internet. Each location breaks out its own traffic. Sending everything through one office is possible, but it turns your tunnel into a bottleneck and the other internet line into an expensive spare.

The tunnel

Right-click A's router, choose Tunnel to, pick B's router and a type. WireGuard is the ordinary choice. The tool makes both key pairs in your browser, takes the next free /30 out of 10.255.255.0 as the transfer network and sets port 13231. Fill in the public address on at least one router, or WireGuard does not know where to connect.

Leave Routes to the other location switched on. The tool then works out from the locations which networks sit on the far side and puts them both in the peer's allowed address and in the routes. For two offices that is enough; you do not need a routing protocol here.

What you get back

• One script per device. Paste all of them, both routers included: a tunnel that exists on one end only does not exist.
• On each router a wg1 interface with an address from the transfer network, a peer with the other side's public key, a keepalive of 25 seconds and the other location's networks as allowed addresses.
• Routes to the far side's subnets, and firewall rules that permit the tunnel traffic without opening anything else.
• A comment on every port saying what is on the other end, inside each location as well as between them.

What the checks report

• Locations on the same subnets. The tool warns you they cannot be joined over a VPN later, which is precisely what you are doing now.
• A location with devices but no router, or with two of them. Each location needs one gateway.
• Two locations using the same address range, or a range that is not two valid numbers.
• No public address on either end of a WireGuard tunnel.
• A VLAN that stops at a cable because one end does not carry it, and a device without the management VLAN.

Mind the MTU. WireGuard uses 1420 by default. If one of the two offices is on PPPoE, expect 1412. A wrong MTU gives you a network that works until someone copies a large file. See MTU and jumbo frames.

Further reading: Example: two locations with a tunnel, A numbering plan that survives growth and Tunnels between locations.