racknerd/docs/TRAVEL-ROUTERS.md

Travel routers (GL.iNet) as roaming WireGuard peers

The three GL.iNet routers connect to the hub as always-on WireGuard clients from 172.31.9.0/24 (hub = 172.31.9.1). They are roaming clients, not sites: they initiate to the hub, carry no LAN routes of their own on the hub side, and NAT their attached devices behind their single WG address — so the DCs see one IP per router.

Security model (be aware): unlike OpenVPN users there is no Duo here — possession of the router's private key is the whole credential. Each router has its own keypair; if one is lost, remove its entry from wg_travel_peers and re-run the playbook — that revokes it completely.

Hub side (all via Ansible)

1. Generate a keypair per router — in the GL.iNet UI (it shows the public key) or manually: wg genkey | tee priv | wg pubkey.
2. Fill wg_travel_peers in group_vars/vpnhub.yml:

   wg_travel_peers:
     - { name: glinet-1, public_key: "xxxx=", ip: 172.31.9.11 }
     - { name: glinet-2, public_key: "yyyy=", ip: 172.31.9.12 }
     - { name: glinet-3, public_key: "zzzz=", ip: 172.31.9.13 }
   

3. ansible-playbook site.yml — appends the peers to wg0.conf (restarts wg0: brief blip for all tunnels), adds the firewall forwards, and registers <name>.roam.atlashorizon.net A + PTR records.
4. Existing deploys only: add 172.31.9.0/24 to the Technitium recursion ACL by hand (console → Settings → Recursion) — that setting was seeded at first boot and isn't re-read from the compose env.

Router side (paste into the GL.iNet WireGuard client UI)

[Interface]
PrivateKey = <this router's private key>
Address = 172.31.9.11/24          # .12 / .13 for the others
DNS = 172.31.9.1                  # Technitium — AD names resolve

[Peer]
PublicKey = <RACKNERD_WG_PUBLIC_KEY>      # printed by setup/playbook
Endpoint = vpn.atlashorizon.net:51820
# FULL TUNNEL (GL.iNet's default, and usually what you want on hotel
# wifi): everything rides the VPN; internet egresses via the VPS
# (masqueraded by the hub firewall).
AllowedIPs = 0.0.0.0/0
# Split-tunnel alternative — only AD/hub networks ride the VPN:
#AllowedIPs = 192.168.20.0/24, 192.168.7.0/24, 172.31.9.0/24, 172.31.255.1/32
PersistentKeepalive = 25

Site side (once, both sites — same drill as the OpenVPN subnet)

• Add 172.31.9.0/24 to the RackNerd peer's AllowedIPs in each site's WG config.
• Return route: 172.31.9.0/24 via the site WG box (LAN router or DCs).
• DC/Windows firewall: allow AD ports from 172.31.9.0/24.
• Optional: AD Sites & Services subnet object for 172.31.9.0/24.

Verify

wg show wg0                        # router peers: recent handshakes
ping 172.31.9.11                   # from the hub
dig @127.0.0.1 -x 172.31.9.11 +short   # glinet-1.roam.atlashorizon.net.
# from a device behind the router:
#   ping ahdc01.ad.atlashorizon.net  (resolves via 172.31.9.1, routes via hub)