Site-to-site VPN with WireGuard or OpenVPN

WireGuard or OpenVPN?

Both VPN types serve remote users (laptops and phones) and sites (other gateways with networks behind them). VPN users are shared by both types.

• WireGuard: a lean, key-based protocol over UDP (port 51820 by default). Each side knows the other's public key; a DNS name as endpoint is resolved again while the site is offline, which helps with dynamic addresses.
• OpenVPN: certificate-based, with a certificate authority on the gateway. The remote gateway imports a configuration file as an OpenVPN client (UDP port 1194 by default); this suits remote routers that offer an OpenVPN client but no WireGuard, and networks that only let TCP traffic through.

Before you start

• The networks of the two sites must not overlap. Renumber one side first if both use the same range.
• Clients and sites connect to the gateway's public address. VYREON opens the VPN port on its internet uplinks; if the gateway sits behind another router, forward the port there.
• A tunnel decides routing, not access. What the remote site may reach is decided by your firewall rules for the VPN zone.

Connect a site with WireGuard

1. Create a WireGuard tunnel on the VPN page, if you do not have one yet.
2. On the tunnel, choose Add site and enter the remote gateway's public key, its endpoint (host and port; leave it empty if the remote side connects to you) and its remote networks: its tunnel address and the networks behind it.
3. Optionally add a preshared key and copy it to the remote side before you save; it is never shown again.
4. Save to the draft and apply the network configuration. VYREON routes the remote networks into the tunnel.
5. On the remote gateway, add this gateway as a peer with its public key, endpoint and the networks it may reach.

Connect a site with OpenVPN

1. On an OpenVPN server, choose Add site, give it a name and check the fixed tunnel address that is proposed.
2. Enter the remote networks behind the site, then create the configuration (you confirm with your password) and download the file.
3. Apply the network configuration. VYREON adds routes to the remote networks through the tunnel.
4. On the remote gateway, import the file as an OpenVPN client. On the server, list the local networks the site should reach as networks pushed to clients.

Allow the traffic in both directions

Traffic from a VPN is filtered by the firewall policy exactly like traffic from any other zone. Allow VPN to LAN for the remote office reaching your network, and LAN to VPN for the other direction, as narrowly as your use allows. Without such rules the default policy applies, which normally drops the traffic. A peer can only send from the addresses it was given.

Verify the link

The site shows as online on the VPN page, with its transfer volumes. Ping a host of the remote network from a local host, and use the packet tracer in the console to see which rule handles the traffic.

Site-to-site VPN on a high availability pair

On an active/standby pair, tunnels, servers and keys are synchronised to the standby, which keeps them down until it takes over. Use the pair's virtual address (or a DNS name pointing to it) as the endpoint on the remote side. After a failover, WireGuard sessions re-establish within about 15 to 25 seconds, and OpenVPN clients reconnect by themselves, usually within the keepalive timeout (60 seconds by default). See the high availability guide.

Limits worth knowing

• Up to 16 WireGuard tunnels and 16 OpenVPN servers, with up to 64 networks per site.
• A default route cannot be routed into a site from the gateway side, so internet traffic cannot break out through a remote office.
• Tunnels and servers are part of the network configuration: they take effect when you apply it, with the usual confirmation timer.

VPN is a licensed feature; existing tunnels keep running without a valid licence. See all firewall features.