travel router

host/rules.v4.template

@@ -43,6 +43,10 @@
 -A FORWARD -i tun0 -o wg0 -s 172.31.8.0/24 -d 192.168.7.0/24 -j ACCEPT
 -A FORWARD -i tun0 -o wg0 -s 172.31.8.0/24 -d 172.31.255.0/24 -j ACCEPT
 
+# Travel routers (roaming WG peers, wg0 -> wg0) -> both sites
+-A FORWARD -i wg0 -o wg0 -s 172.31.9.0/24 -d 192.168.20.0/24 -j ACCEPT
+-A FORWARD -i wg0 -o wg0 -s 172.31.9.0/24 -d 192.168.7.0/24 -j ACCEPT
+
 # Site -> client NEW connections (e.g. RDP/RSAT from a DC to a roaming
 # laptop). Off by default; uncomment if you need it.
 #-A FORWARD -i wg0 -o tun0 -d 172.31.8.0/24 -j ACCEPT

host/wg0.conf.example

@@ -3,7 +3,8 @@
 # paste in each site's public key afterwards.
 
 [Interface]
-Address = 172.31.255.1/24
+# .255 = site transfer net, .9 = roaming WG peers (travel routers)
+Address = 172.31.255.1/24, 172.31.9.1/24
 ListenPort = 51820
 PrivateKey = <RACKNERD_WG_PRIVATE_KEY>
 # wg-quick auto-adds routes for each peer's AllowedIPs — that is exactly
@@ -25,3 +26,11 @@ AllowedIPs = 172.31.255.3/32, 192.168.7.0/24
 # Deliberately NOT listing the other site's LAN under either peer:
 # Oswald<->Trochalakis traffic must stay on their direct tunnel, never
 # hairpin through this box.
+
+# ── Travel routers (roaming /32 peers from 172.31.9.0/24) ──
+# The Ansible deploy appends these from the wg_travel_peers list in
+# group_vars. For manual setups, copy this block per router:
+#[Peer]  # glinet-1
+#PublicKey = <ROUTER_WG_PUBLIC_KEY>
+#AllowedIPs = 172.31.9.11/32
+# (no Endpoint — routers initiate and keep alive from behind NAT)